[SpyZzey]

Updates one transitive dependency in package-lock.json to resolve the one open Dependabot security alert in this repository that has no auto-generated update pull request. package.json is unchanged.

Alert addressed

• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 2.1.4 -> 2.1.7

How it was fixed

brace-expansion is reachable only as a nested transitive dependency (readdir-glob > minimatch), so the single affected lockfile entry was moved to the patched 2.1.7 release, which satisfies the existing minimatch@^2.0.1 range. The entry is dev-only, so no published artifact changes.

The diff is three lines: no other dependency version changed, and nothing unrelated was upgraded. npm audit no longer reports a brace-expansion advisory after the change.

Scope

This PR covers only the alert above. The repository's other two open alerts already have their own auto-generated update pull requests, which stay open and are reviewed separately:

• chore: bump source-map-js from 1.2.1 to 1.2.2 #477 — source-map-js 1.2.1 -> 1.2.2
• chore: bump shell-quote from 1.10.0 to 1.12.0 #478 — shell-quote 1.10.0 -> 1.12.0

Merging this PR is expected to clear the one alert it covers, leaving none of its own alerts open.

brace-expansion@2.1.7 is available internally.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.68%. Comparing base (18fd4b7) to head (200d6db).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #479   +/-   ##
=======================================
  Coverage   93.68%   93.68%           
=======================================
  Files          59       59           
  Lines        1821     1821           
  Branches      490      486    -4     
=======================================
  Hits         1706     1706           
  Misses        115      115           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.