chore(deps): bump brace-expansion from 2.1.2 to 2.1.4

[dependabot]

Bumps brace-expansion from 2.1.2 to 2.1.4.

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[joshuanapoli]

Summary

Bumps brace-expansion 2.1.2 -> 2.1.4, which backports the fix for GHSA-mh99-v99m-4gvg (ReDoS in the range/expansion parser). Lockfile/PnP-cache only; no source or manifest changes.

Risks

Low.

• brace-expansion is not a direct dependency and is not referenced in src/. The 2.x resolution reaches us only via minimatch@9.0.9 (brace-expansion: "npm:^2.0.2"), inside the dev toolchain. Our runtime dependencies (axios, commander) do not pull minimatch in, so the shipped CLI is unaffected.
• Patch-level within the same major; the public API (expand()) is unchanged. The fix bounds parser backtracking rather than altering expansion results, so glob semantics for ESLint/Jest path matching stay the same.
• The repo also resolves brace-expansion@^5.0.2 -> 5.0.4 via minimatch@10.2.4; that entry is untouched by this PR, so the two majors remain independently resolved as before.

Analysis

• Reviewed the commit list for v2.1.2...v2.1.4: the substantive commits are the GHSA-mh99-v99m-4gvg backport (#130) and a fork security merge; the rest are a version bump and an .npmignore tweak.
• Diffed yarn.lock against main: a single block changes (version, resolution, checksum). balanced-match: ^1.0.0 is unchanged and there is no unrelated resolution drift.
• Traced reverse dependencies in the lockfile to confirm dev-only, transitive usage.
• CI (test job, workflow CI) ran against the current head commit 44e1009 and passed. That job runs yarn install --immutable --immutable-cache, which validates the lockfile and the Yarn PnP zip cache in this diff, then prettier --check, eslint ., jest, and tsc — exercising the glob matching that consumes this package.

No mitigating changes were needed.