fix(deps): brace-expansion 5.0.8 on top of #50 (5.0.7 is still vulnerable)

[yakimoto]

User description

Builds on #50 and takes brace-expansion one version further, to the one that actually clears the advisory.

brace-expansion  5.0.7 → 5.0.8      (on top of #50's eslint upgrade)

Four lines on top of #50. Merge this instead of #50 — it contains #50 in full.

#50 does the hard part, then stops one version short

brace-expansion has two live advisories. #50 targets the older >= 3.0.0, < 5.0.7 (fix 5.0.7). The newer — GHSA-mh99-v99m-4gvg, range <= 5.0.7, patched in 5.0.8 — puts 5.0.7 inside the vulnerable range. So #50 lands on a version that is still flagged.

Measured, dev scope included, on all three states:

	brace-expansion	total	high	remaining
main @ eb79119	1.1.15	3	2	brace-expansion, esbuild, js-yaml
#50 as-is	5.0.7	2	1	brace-expansion still flagged, esbuild
this PR	5.0.8	1	0	esbuild (low, dev-only)

Why #50's approach is the right one, and worth saying out loud

I expected this repo to be unfixable. It was the worst case in the fleet survey (wave-av/claude-workstation#562): main carries two trees at once —

node_modules/minimatch                                          -> 3.1.5
node_modules/brace-expansion                                    -> 1.1.15
node_modules/@typescript-eslint/typescript-estree/…/minimatch   -> 10.2.5
node_modules/@typescript-eslint/typescript-estree/…/brace-expansion -> 5.0.6

minimatch@3.1.5 does const expand = require('brace-expansion') and calls the result as a function, while every patched brace-expansion exports an object. Forcing a patched version onto that tree produces TypeError: expand is not a function at runtime while npm audit reports clean — claude-workstation#554, where it also passed 195/195 tests. And the root tree's own alert (< 1.1.16) is a trap inside the trap: 1.1.16 is API-compatible, but it was published 2026-07-08, before the fix landed on 2026-07-23, and the v1 line never got the backport. API-compatible is not the same as patched.

The conclusion I'd drawn from that was "dismiss it, no safe fix exists." That was wrong, and #50 is why. Rather than overriding brace-expansion under a consumer that can't take it, #50 upgrades the consumer: bumping eslint moves @eslint/config-array from minimatch: ^3.1.5 to ^10.2.4 and drops @eslint/eslintrc entirely — the two things that were pinning minimatch@3. The result is a single hoisted tree with no minimatch@3 anywhere:

$ git show refs/pull/50/head:package-lock.json | …
node_modules/brace-expansion -> 5.0.7
node_modules/minimatch       -> 10.2.5
any minimatch@3? False

Once minimatch@3 is gone, 5.0.8 is simply safe — minimatch@10 uses named exports and expects the object shape. The general rule, the one worth keeping: when a transitive dependency can't be patched, upgrade the parent that pins it rather than overriding the child.

It also incidentally clears the js-yaml HIGH (alert #5), because @eslint/eslintrc was what pulled js-yaml@4.2.0 in. That makes #53 redundant — see my comment there.

Verification

CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, re-confirmed live today). All local, Node 22.14.0:

npm run lint        → clean (--max-warnings 0)
npm run type-check  → clean
npm run build       → ESM 31.72 KB + CJS 34.04 KB, success

npm run lint is the one that matters here, not a formality: eslint is the actual consumer of minimatch/brace-expansion, and #50 upgrades eslint itself. A clean --max-warnings 0 run over src/ exercises the changed dependency end-to-end.

This repo has no test suite, so I also drove the module directly — npm audit only compares version strings and never loads anything:

minimatch 10.2.5 | brace-expansion 5.0.8
match  : true      # minimatch('file2.js','file{1,2}.js')
control: false     # minimatch('file3.js','file{1,2}.js')
nested : true      # minimatch('a/b/c.ts','a/{b,d}/{c,e}.ts')
be export: object EXPANSION_MAX,EXPANSION_MAX_LENGTH,expand

That last line is precisely the shape that breaks minimatch@3 — and brace expansion resolves correctly through minimatch@10.

Measurement caveat: this workstation exports NODE_ENV=production, which makes npm audit inherit omit=dev and hide dev-scope entries entirely — which is all of these. Every figure above was taken with NODE_ENV=development set explicitly.

Unrelated thing I noticed

This repo has no .gitignore, so node_modules/ shows up as untracked rather than ignored. On a public repo that's one git add -A away from a very bad commit. Not fixing it in this PR; flagging it as worth its own.

---

Note

Low Risk
Dev-only dependency and lockfile updates; runtime/published @wave-av/adk code is unchanged, with main risk being local/CI lint on older Node versions.

Overview
Bumps the dev dependency eslint from ^9.39.4 to ^10.7.0 and refreshes package-lock.json so the lint toolchain no longer pulls the old minimatch@3 / brace-expansion@1.x tree.

The lockfile change hoists minimatch@10 and brace-expansion@5.0.8 (clearing the remaining advisory that 5.0.7 still hit), drops @eslint/eslintrc and related legacy packages (e.g. js-yaml, chalk stack), and raises ESLint’s Node engine to ^20.19.0 || ^22.13.0 || >=24 for local npm run lint. No source or ESLint config files are modified in this diff.

^{Reviewed by Cursor Bugbot for commit 2f5225e. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

Summary by cubic

Upgrades eslint to ^10.7.0 and resolves brace-expansion to 5.0.8 so the dev tree clears the remaining advisory (GHSA-mh99-v99m-4gvg) with zero vulnerabilities across 182 packages. 5.0.7 is still inside the vulnerable range, so this goes one version past #50 instead of stopping there.

Dependencies

• eslint@10 hoists minimatch to 10.x and removes @eslint/eslintrc, which also clears the js-yaml advisory.
• The merge against main (which stayed on eslint 9) kept the eslint-10 tree and reconciled the lockfile with npm install --package-lock-only.
• No main-only files were dropped; the merge honors main removing .github/workflows/publish.yml.

Migration

• Development now requires Node 20.19+ for eslint tooling.

^{Written for commit 2f5225e. Summary will update on new commits.}

Summary by Sourcery

Upgrade ESLint and its dependency tree to eliminate the remaining vulnerable brace-expansion version.

Bug Fixes:

• Resolve the remaining brace-expansion security advisory by updating the linting dependency tree to use brace-expansion 5.0.8.

Enhancements:

• Upgrade ESLint to 10.7.0, removing legacy dependency paths and consolidating the dependency tree around compatible minimatch versions.

Tests:

• Verify linting, type checking, and builds continue to pass with the updated dependency stack.

---

CodeAnt-AI Description

Update development tooling and remove the remaining vulnerable brace-expansion version

What Changed

• Updates ESLint from 9.39.4 to 10.7.0, along with its compatible dependency set
• Resolves brace-expansion at 5.0.8 instead of vulnerable 5.0.7 or older versions
• Updates related pattern-matching packages and removes obsolete transitive dependencies from the lockfile
• Requires Node.js 20.19+, 22.13+, or 24+ for the updated ESLint toolchain

Impact

✅ Vulnerable brace-expansion version removed
✅ Current ESLint development checks
✅ Cleaner dependency installation

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ba923b1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a63ec7c5-d234-4f37-a039-c11cb5279763)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​9.39.4 ⏵ 10.7.0	+1			+47

View full report

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 406ed7c8-8f7a-4b83-a5fd-ad1e99e1453a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ESLint development dependency in package.json is updated from ^9.39.4 to ^10.7.0.

Changes

ESLint Version Update

Layer / File(s)	Summary
Update ESLint development dependency package.json	Changes the declared ESLint development dependency from ^9.39.4 to ^10.7.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the PR's main change: bumping brace-expansion to 5.0.8 to address the remaining vulnerability.
Description check	✅ Passed	The description clearly explains what changed and why, but it does not follow the template headings or include the checklist section.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/brace-expansion-5-0-8-on-eslint-bump

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/brace-expansion-5-0-8-on-eslint-bump

Warning

Review ran into problems

🔥 Problems

These MCP integrations need to be re-authenticated in the Integrations settings: Sentry

---

_{Comment @coderabbitai help to get the list of available commands.}

[wave-bugbot]

🌊 WAVE BugBot — 5 finding(s)

🔴 4 · 🟠 1

• 🔴 P0 package-lock.json:511 CWE-862 — Missing role guard for SECURITY DEFINER RPCs
  The package-lock.json file is updated, but there are no changes to the code that implement role guards for SECURITY DEFINER RPCs. This could allow unauthorized
• 🔴 P0 package-lock.json:511 CWE-89 — Potential SQL injection vulnerability due to outdated dependencies
  The package-lock.json file is updated, but there are no changes to the code that use parameterized queries. Outdated dependencies could be vulnerable to SQL inj
• 🔴 P0 package-lock.json:511 CWE-918 — Potential SSRF vulnerability due to outdated dependencies
  The package-lock.json file is updated, but there are no changes to the code that validate outbound URLs. Outdated dependencies could be vulnerable to SSRF if no
• 🔴 P0 package-lock.json:511 CWE-798 — Potential secret leak due to outdated dependencies
  The package-lock.json file is updated, but there are no changes to the code that handle secrets securely. Outdated dependencies could be vulnerable to secret le
• 🟠 P1 package-lock.json:511 CWE-426 — Unpinned search_path on SECURITY DEFINER function
  The package-lock.json file is updated, but there are no changes to the code that pin the search_path for SECURITY DEFINER functions. This could allow an attacke

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	2f5225e	Sep 08, 2026 · 18:23	18:25

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_6017fc10-0391-4bd6-a3e8-d0e0b88aeed8)

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The change is confined to dependency metadata and lockfile paths and appears limited to the development toolchain, with no production source or API changes. Its explicit purpose is to remediate a vulnerable dependency, so the security-sensitive nature warrants manual review despite the narrow scope.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[codeant-ai]

Suggestion: On Node 18 or Node 20 before 20.19, this ESLint version is unsupported; installation may continue with a warning, then npm run lint can fail at runtime. [possible bug]

Assessment: 🟠 Major · 🔁 Occurrence: Rarely

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** package.json
**Line:** 57:57
**Comment:**
	*Possible Bug: On Node 18 or Node 20 before 20.19, this ESLint version is unsupported; installation may continue with a warning, then `npm run lint` can fail at runtime.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎