Revert the brace-expansion CVE suppressions from #463

Removes the two [[IgnoredVulns]] entries added in #463, restoring
osv-scanner.toml to having no suppressions. The real dependency
bumps from that PR are deliberately kept: brace-expansion 1.1.16 /
2.1.3 and ip-address 10.3.1 (the latter a production dependency via
socks) all stay in package-lock.json.

Why revert: [[IgnoredVulns]] entries are CVE-id global in OSV-Scanner
v2.3.8 -- they silence the advisory across every package it is
reported against, not just brace-expansion. That is broader than the
problem being solved, and the entries landed inside a security PR
without a security reviewer explicitly signing off on them. Backing
them out so the decision can be made on its own merits.

Consequence, intentional: the Security Scan gate fails again on three
dev-only brace-expansion findings (GHSA-mh99-v99m-4gvg,
GHSA-rgw5-rvv9-x895). There is no published fix -- the advisories name
1.1.17/1.1.18/2.1.4 but npm's latest releases are 1.1.16 and 2.1.3.
These are dev-only: brace-expansion reaches us solely via the
eslint/glob/test-exclude toolchains through minimatch, `npm ls
brace-expansion --omit=dev` is empty, and both lockfile entries are
marked "dev": true, so they are not reachable from the published
dist/. Impact is DoS on adversarial brace patterns, which would
require untrusted input to our own lint/test globs.

Note the gate was already failing on main before #463 for these same
dependencies, so this restores the prior state rather than causing a
new regression.

Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

Author: msrathore-db

osv-scanner.toml

@@ -30,29 +30,3 @@
 # This file starts empty -- populate iteratively as the first scan run
 # surfaces real false positives or dev-only findings worth excluding.
 # Do not pre-populate with speculative suppressions.
-
-# brace-expansion DoS advisories, both with NO published fix as of
-# 2026-08-05: the advisories name 1.1.17/1.1.18 and 2.1.4 as fixed, but
-# npm's latest published releases are 1.1.16 and 2.1.3. So there is
-# nothing to bump to -- we already bumped as far as the registry allows
-# (1.1.15 -> 1.1.16, 2.1.1 -> 2.1.3, which cleared the earlier
-# GHSA-3jxr-9vmj-r5cp).
-#
-# Dev-only: brace-expansion reaches us solely through the eslint /
-# glob / test-exclude toolchains via minimatch. `npm ls brace-expansion
-# --omit=dev` is empty, and both lockfile entries are marked
-# "dev": true, so it is not reachable from the published dist/.
-# The impact is DoS (ReDoS / OOM) on adversarial brace patterns, which
-# would require untrusted input to our own lint/test globs.
-#
-# Revisit when 1.1.18 / 2.1.4 land on npm and drop these entries.
-
-[[IgnoredVulns]]
-id = "GHSA-mh99-v99m-4gvg"
-ignoreUntil = "2027-02-05T00:00:00Z"
-reason = "dev-only (eslint/glob/test-exclude -> minimatch); not reachable from shipped dist/. No published fix: advisory lists 1.1.17 as fixed but 1.1.16 is npm's latest 1.x."
-
-[[IgnoredVulns]]
-id = "GHSA-rgw5-rvv9-x895"
-ignoreUntil = "2027-02-05T00:00:00Z"
-reason = "dev-only (eslint/glob/test-exclude -> minimatch); not reachable from shipped dist/. No published fix: advisory lists 1.1.18/2.1.4 as fixed but npm's latest are 1.1.16/2.1.3."