fix: update brace-expansion to resolve GHSA-rgw5-rvv9-x895 (DEVX-8505)

[warp-agent-staging]

Summary

Resolves GHSA-rgw5-rvv9-x895 (high severity denial-of-service in brace-expansion) for DEVX-8505.

This advisory covers an incomplete fix from the earlier maxLength mitigation (GHSA-mh99-v99m-4gvg / CVE-2026-14257): intermediate arrays built before combine() are still unbounded, so a ~25 KB input can trigger an uncatchable Node OOM, and a ~400 KB padded-sequence input can block the event loop for minutes.

Two Dependabot alerts were filed against this repo's package-lock.json, both at development scope, and both were auto-dismissed by GitHub at creation under Dependabot's dev-scope auto-triage rule — there was no open Dependabot PR:

• Alert 120: vulnerable range < 1.1.18, first patched version 1.1.18
• Alert 121: first patched version 2.1.4

Given the dev-only scope and auto-dismissed status, this is a low-risk, build/tooling-only exposure, but the fix is cheap so we're closing it out proactively.

Changes

• package-lock.json: bumped the transitive brace-expansion dependency (pulled in via minimatch) from 1.1.17 → 1.1.18 and from 2.1.3 → 2.1.4.
• No package.json changes were needed — the fix was achieved with a targeted npm update brace-expansion, since both minimatch dependents (minimatch@3.1.5 requiring ^1.1.7, minimatch@9.0.9 requiring ^2.0.2) already declare semver ranges that permit the patched versions. No overrides entry was required.

Before / after

Before (npm ls brace-expansion --all):

+-- @eslint/eslintrc@3.3.3
|   `-- minimatch@3.1.5
|     `-- brace-expansion@1.1.17
+-- tailwindcss@3.4.19
|   `-- sucrase@3.35.0
|     `-- glob@10.5.0
|       `-- minimatch@9.0.9
|         `-- brace-expansion@2.1.3
`-- typescript-eslint@8.54.0
    `-- @typescript-eslint/typescript-estree@8.54.0
      `-- minimatch@9.0.9
        `-- brace-expansion@2.1.3

After:

+-- @eslint/eslintrc@3.3.3
|   `-- minimatch@3.1.5
|     `-- brace-expansion@1.1.18
+-- tailwindcss@3.4.19
|   `-- sucrase@3.35.0
|     `-- glob@10.5.0
|       `-- minimatch@9.0.9
|         `-- brace-expansion@2.1.4
`-- typescript-eslint@8.54.0
    `-- @typescript-eslint/typescript-estree@8.54.0
      `-- minimatch@9.0.9
        `-- brace-expansion@2.1.4

Verification

• npm update brace-expansion — lockfile refresh, found 0 vulnerabilities.
• rm -rf node_modules && npm ci — clean install succeeds, found 0 vulnerabilities.
• npm ls brace-expansion --all — confirms only patched versions (1.1.18, 2.1.4) remain in the tree.
• npm run lint (eslint .) — passes with no errors.
• npm run build (tsc lib/*.ts && next build) — fails with Error: appId is missing while collecting page data (Algolia search config not available in this sandbox). Confirmed this same failure occurs identically on main with a clean install, so it is unrelated to this change and pre-existing in this environment.

Ref: DEVX-8505

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
commands-dev	Ready	Preview	Aug 14, 2026 4:30pm