fix(deps): restore brace-expansion's lower advisory bound

[willgriffin]

{"schema":"hv-agent-run:v1","runtime":"claude","session":"8a94e288-0358-403f-a3a6-8e81a80e6c5d","issue":"2204","head_sha":"4ff760d21e7ea7b4a119c2c9d1f7c7e1272461fd","policy_revision":"1.0.0","status":"complete"}

Rescoped. This PR originally widened the undici and fast-uri overrides. Both landed independently in #2210 — with the advisory lower bounds intact, exactly as the reviewers below asked for — so those hunks are gone and the branch is rebased onto main. What remains is the same finding applied to the third selector, which #2203 got wrong and which is live on main today.

Summary

-  'brace-expansion@<5.0.9': 5.0.9
+  'brace-expansion@>=4.0.0 <5.0.9': 5.0.9

Why

GHSA-rgw5-rvv9-x895 is >=4.0.0 <5.0.9. #2203 fixed that override's upper bound (it had been pinned to 5.0.8, the release the advisory later grew to cover) but dropped the lower bound entirely, so the bare @<5.0.9 also matches every 1.x, 2.x, and 3.x dependency. Any consumer of an older major would be forced onto 5.0.9 — a breaking upgrade for a release outside the advisory.

Both bounds matter, independently:

• the upper bound must track the advisory, or the override goes stale the moment the advisory widens (the fix(deps): brace-expansion override pins a version the widened advisory now covers #2202 / fix(deps): undici and fast-uri overrides pin versions their widened advisories now cover #2204 failure mode);
• the lower bound must track the advisory, or the override reaches past it into unaffected majors (the finding on this PR).

pnpm-workspace.yaml even carries a comment noting minimatch 9 was the last consumer of brace-expansion 2.x — precisely the range the bare selector would have captured.

Validation

• pnpm audit: 1 low | 6 moderate before and after — verified against unmodified main. Zero high, so the CI gate passes
• brace-expansion appears in neither report, so narrowing resurfaces nothing
• Only lockfile change is the mirrored override key; no package resolution moves
• pnpm audit:policy: green — 5 accepted records, 0 suppressions

Still stale, not fixed here

'postcss@<=8.5.17': 8.5.18 has the same expired-upper-bound shape — its advisory is now <=8.5.22. It surfaces as a moderate, so it does not fail the gate; flagging rather than folding it into this PR.

Closes #2204

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbe4f89913

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Updates root pnpm overrides to ensure undici and fast-uri are pinned to patched versions after their advisories’ vulnerable ranges expanded, unblocking the high-severity dependency audit gate across PRs and main.

Changes:

• Update the undici override to pin 7.29.0 (patched for GHSA-4cwx-7wf7-3272).
• Update the fast-uri override to pin 3.1.5 (patched for GHSA-7p8r-x3mc-p8w7).
• Regenerate pnpm-lock.yaml to reflect the new override targets and resolved transitive versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pnpm-workspace.yaml	Adjusts root overrides for undici and fast-uri to pinned patched versions.
pnpm-lock.yaml	Lockfile refresh reflecting the new override selectors and resolved versions.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

pnpm-workspace.yaml:64

• The override selector is broader than the advisory range. fast-uri@<3.1.5 would also apply to any <3.0.0 versions (if they ever appear), potentially introducing an unintended major bump. Matching the advisory range (>=3.0.0 <3.1.5) aligns with AGENTS.md guidance and keeps the override narrowly targeted.

  'fast-uri@<3.1.5': 3.1.5

[github-actions]

Removed from the merge queue — reason: CI_FAILURE

A required status check went red on the merge-group head. Open the linked run and read the failing leaf job (shard), not the rollup — the rollup only mirrors it.

Latest merge-group validation run for this PR: https://github.com/happyvertical/smrt/actions/runs/31043921215

_{merge-queue-watchdog: dequeue events are otherwise invisible; this comment makes queue ejections diagnosable (#2197).}