From ddb82daf32d39950f9068cd3aa1dc5128f9db96b Mon Sep 17 00:00:00 2001
From: Blake Gentry <blakesgentry@gmail.com>
Date: Fri, 24 Jul 2026 06:52:41 -0500
Subject: [PATCH] bump brace-expansion to 5.0.8

`brace-expansion` 5.0.7 remains vulnerable to
GHSA-mh99-v99m-4gvg, where chained brace groups can exhaust Node's
memory.

Resolve 5.0.8 through the existing `minimatch` dependency range. The
patched release bounds total expansion length while retaining the count
limit, preventing unbounded allocation in developer and CI tooling.
---
 package-lock.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 2263dac..192de48 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4982,16 +4982,16 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/browserslist": {