Bump brace-expansion from 1.1.16 to 1.1.18

[dependabot]

Bumps brace-expansion from 1.1.16 to 1.1.18.

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[joshuanapoli]

Summary

Bumps the transitive brace-expansion 1.1.16 → 1.1.18 in package-lock.json, closing two HIGH-severity denial-of-service advisories:

• GHSA-mh99-v99m-4gvg (patched 1.1.17) — unbounded expansion length causing an out-of-memory process crash.
• GHSA-rgw5-rvv9-x895 (patched 1.1.18) — unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation.

I pushed one correction commit: build: rebuild dist for brace-expansion 1.1.18.

Risks

• The patch did not actually ship. This is a GitHub Action and dist/ is committed because the runner executes it directly. Dependabot only updated package-lock.json, so the bundled copy of brace-expansion inside dist/restore.mjs and dist/save.mjs stayed on the vulnerable 1.1.16 code. Merging as-authored would have closed the Dependabot alert while leaving the running action unpatched — the worst outcome, since the alert stops nagging but the vulnerability remains. CI caught this correctly: Check dist is current failed with "dist/ is stale".
• Rebuild scope. Regenerating dist/ from a 2.3 MB bundle risks sweeping in unrelated drift. Verified it did not: all 16 diff hunks in each of the two bundles fall inside var require_brace_expansion = __commonJS({, and nothing else in either file changed.
• Behavioral change from the fix itself. 1.1.18 introduces defaults that did not previously exist — EXPANSION_MAX = 1e5 (was Infinity) and a new EXPANSION_MAX_LENGTH = 4e6. Brace expansions above those bounds now truncate rather than run away. This action reaches brace-expansion through minimatch under @actions/cache, and its only glob is the fixed internal cache pattern for project slugs — nowhere near 100,000 expansions, and not attacker-controlled. No practical impact.
• Stale branch. The PR was cut 11 days ago. I updated it from main before rebuilding so dist/ was regenerated against current src/, not an 11-day-old tree.

Analysis

Worked in a dedicated worktree on dependabot/npm_and_yarn/brace-expansion-1.1.18:

1. gh pr update-branch to merge current main into the branch.
2. npm ci — clean, found 0 vulnerabilities.
3. npm test — 7 tests, all passing, including the cache-glob and key-uniqueness assertions.
4. npm run build — esbuild regenerated both bundles.
5. Inspected git diff -- dist before committing. The change is exactly the upstream hardening: max now defaults to EXPANSION_MAX instead of Infinity, a new maxLength parameter threads through expand(), and the rewritten combine() / expandSequence() helpers bail out once out.length >= max or the accumulated length would exceed maxLength. That is the fix for both advisories, now actually present in the executed artifact.
6. Committed dist/ and pushed.

CI is green on the head commit — both build runs pass, including the Check dist is current step that was previously failing.