ci(deps): pin brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895 (#4945)

.changeset/brace-expansion-advisory-5-0-9.md

@@ -0,0 +1,26 @@
+---
+---
+
+ci(deps): lift the `brace-expansion` pin to 5.0.9 so `Validate Package Dependencies` stops failing on every PR (#4945)
+
+`GHSA-rgw5-rvv9-x895` (7.5 high) affects `brace-expansion` 5.0.8 — which is
+exactly the version the previous pin (`brace-expansion@>=5.0.0 <5.0.8: ^5.0.8`,
+added for `GHSA-mh99-v99m-4gvg`) had settled on. The OSV-Scanner step in
+`.github/workflows/validate-deps.yml` reads `pnpm-lock.yaml` directly and exits
+non-zero on any match, so the job was red on `main` itself and attached that red
+to every PR that touched a manifest or the lockfile, whatever the PR contained
+(observed on #4944, which never touched `pnpm-lock.yaml`).
+
+The `pnpm-workspace.yaml` override bound moves to `<5.0.9` / `^5.0.9`. It stays a
+transitive-only pin — nothing declares `brace-expansion` directly; it arrives via
+`minimatch` (ts-morph, eslint, `@typescript-eslint`, glob, `@vscode/vsce`,
+archiver), so no published manifest changes and `check-override-consistency`
+still has nothing to reconcile. 5.0.8 disappears from the lockfile entirely; the
+three `minimatch` snapshots that referenced it now resolve 5.0.9.
+
+The reason to fix this on its own rather than let it ride along with the next
+dependency PR is the one the issue names: a permanently red required check
+trains everyone to scroll past it, and the next real advisory will look exactly
+like this one in the PR list.
+
+Lockfile and override metadata only; releases nothing.

pnpm-workspace.yaml

@@ -105,13 +105,16 @@ overrides:
   svelte: '^5.55.7'
   '@tootallnate/once@<2.0.1': '2.0.1'
   # OSV batch 2026-07 — transitive-only fixes (no publishable package declares these):
-  # brace-expansion GHSA-mh99-v99m-4gvg (via minimatch@10.x); sharp GHSA-f88m-g3jw-g9cj
+  # brace-expansion GHSA-mh99-v99m-4gvg (via minimatch@10.x), then GHSA-rgw5-rvv9-x895
+  # (7.5 high) which affects 5.0.8 itself — the version the first pin landed on — so the
+  # bound moves to <5.0.9. Still transitive-only through minimatch (ts-morph, eslint,
+  # @typescript-eslint, glob, @vscode/vsce, archiver); sharp GHSA-f88m-g3jw-g9cj
   # (next optionalDep ^0.34.5 excludes the fix); react-router GHSA-qwww-vcr4-c8h2 has no
   # 7.x fix — fumadocs-core peer allows 8.x and docs uses the next adapter, so jump to 8;
   # @sveltejs/kit GHSA-866w-xmhq-wj7x/GHSA-wqjv-9729-c5q2 (better-auth optional peer);
   # @hono/node-server GHSA-frvp-7c67-39w9 has no 1.x fix — @modelcontextprotocol/sdk
   # declares ^1.19.9 and only imports getRequestListener, which 2.x still exports.
-  'brace-expansion@>=5.0.0 <5.0.8': '^5.0.8'
+  'brace-expansion@>=5.0.0 <5.0.9': '^5.0.9'
   'sharp@>=0.34.0 <0.35.0': '^0.35.0'
   'react-router@<8.3.0': '^8.3.0'
   '@sveltejs/kit@<2.69.1': '^2.69.1'