[security] Resolve brace-expansion Vulnerability via pnpm Override

[hayat01sh1da]

1. Overview

Dependabot alerts #688 (javascript/pnpm-lock.yaml) and #690 (typescript/pnpm-lock.yaml) both report GHSA-mh99-v99m-4gvg / CVE-2026-14257 (High, CVSS 7.5) against the transitive dependency brace-expansion.

expand() caps the number of results it produces but not their length, so chained brace groups such as '{a,b}'.repeat(1500) exhaust memory and kill the Node process with an uncatchable out-of-memory error.

The advisory marks every published version up to 5.0.7 as vulnerable and ships the fix only in 5.0.8 — there is no backport on the 1.x or 2.x maintenance lines, so the two versions in both trees (1.1.16 and 2.1.2) cannot simply be patch-bumped.

Because brace-expansion@5 exposes a named expand export instead of a callable module.exports, the consumers that still expect the old shape (minimatch@3.1.5 via require(), minimatch@9.0.9 via a default import) had to move forward as well.

This Pull Request therefore resolves the whole chain through pnpm overrides in javascript/pnpm-workspace.yaml and typescript/pnpm-workspace.yaml, matching the existing js-yaml override convention.

2. Key Changes & Differences

Package	Before	After	Changes & Differences
brace-expansion	1.1.16, 2.1.2	5.0.8	The only patched release for GHSA-mh99-v99m-4gvg; EXPANSION_MAX_LENGTH (4,000,000) now bounds total output length in addition to EXPANSION_MAX.
minimatch	3.1.5, 9.0.9	10.2.5	3.1.5 calls require('brace-expansion')(pattern) and 9.0.9 calls its default export — both break against brace-expansion@5, whose CJS build exports only { expand, EXPANSION_MAX, EXPANSION_MAX_LENGTH }. 10.2.5 uses the named expand import and passes braceExpandMax.
babel-plugin-istanbul	7.0.1	8.0.2	7.0.1 pins test-exclude@^6.0.0, which drags in glob@7 → minimatch@3 → brace-expansion@1. 8.0.2 pins test-exclude@^7.0.1, removing that leg of the tree.
test-exclude (transitive)	6.0.0	7.0.2	Pulled in by the babel-plugin-istanbul bump; depends on glob@^10.4.1 and minimatch@^10.2.2 instead of glob@^7.1.4 and minimatch@^3.0.4.
glob (transitive)	7.2.3, 10.5.0	10.5.0 (javascript) / 7.2.3, 10.5.0 (typescript)	In javascript glob@7.2.3 existed only to serve test-exclude@6.0.0 and disappears with it. In typescript it is also required by glob-stream@6.1.0 (gulp) and therefore stays, but now resolves minimatch@10.2.5; a glob@7 brace-pattern smoke test against that combination was run and returns the expected matches.
javascript/pnpm-workspace.yaml, typescript/pnpm-workspace.yaml	1 override (js-yaml)	4 overrides	Added 'brace-expansion@<=5.0.7': '^5.0.8', 'minimatch@<10.2.2': '^10.2.5' and 'babel-plugin-istanbul@<8.0.2': '^8.0.2' next to the existing js-yaml entry in both workspaces.

3. Summary

• 2 High-severity Dependabot alerts resolved (#688 and #690): brace-expansion 1.1.16/2.1.2 → 5.0.8, leaving a single copy of the package in each tree.
• 3 pnpm overrides added per workspace; babel-plugin-istanbul and minimatch are bumped only because brace-expansion@5 changed its export shape, not as an independent upgrade.
• pnpm exec jest (the command JavaScript - CI and TypeScript - CI run) passes in both workspaces: 19 suites / 153 tests in javascript, 5 suites / 5 tests in typescript.
• pnpm exec jest --coverage also passes in both, which exercises the babel-plugin-istanbul → test-exclude → glob path that this change rewires.
• reactjs/pnpm-lock.yaml and ruby-on-rails/perfect-ruby-on-rails/pnpm-lock.yaml also contain brace-expansion@1.1.16 but have no Dependabot alert raised against them, so they are deliberately left out of this Pull Request.

4. References

• javascript/pnpm-workspace.yaml
• javascript/pnpm-lock.yaml
• typescript/pnpm-workspace.yaml
• typescript/pnpm-lock.yaml
• Dependabot alert #688
• Dependabot alert #690
• GHSA-mh99-v99m-4gvg
• CVE-2026-14257
• brace-expansion on npm
• pnpm — overrides

[hayat01sh1da]