fix: update brace-expansion to resolve CVE-2026-69152, CVE-2026-14257, CVE-2026-13149

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

brace-expansion is a transitive dependency present in three major-version lines in the lockfile, all vulnerable to DoS advisories. Replaced the single existing brace-expansion@5.0.6 override with one pin per major line so every copy resolves to a patched version.

• Dependency: brace-expansion pinned via npm overrides
  • brace-expansion@1: 1.1.12 → 1.1.18
  • brace-expansion@2: 2.0.2 → 2.1.4
  • brace-expansion@5: 5.0.7 → 5.0.9
  • (minimatch copies resolve through these pins, so its audit finding clears too)
• Advisories:
  • CVE-2026-69152 / GHSA-rgw5-rvv9-x895 — DoS via unbounded intermediate arrays
  • CVE-2026-14257 / GHSA-mh99-v99m-4gvg — DoS via unbounded expansion length (OOM crash)
  • CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp — DoS via exponential-time expansion
• Dependabot alerts:
  • https://github.com/warpdotdev/oz-workspace/security/dependabot/143
  • https://github.com/warpdotdev/oz-workspace/security/dependabot/138
  • https://github.com/warpdotdev/oz-workspace/security/dependabot/131
  • https://github.com/warpdotdev/oz-workspace/security/dependabot/130
• Verification:
  • npm audit: brace-expansion and minimatch no longer reported (were 4 high findings)
  • npm ci from the regenerated lockfile: clean, 901 packages
  • prisma generate: OK
  • npm run lint: 0 errors (6 pre-existing warnings, unchanged)
  • next build: compiled successfully, TypeScript clean, all 35 pages generated

Highlight the risky code / where the dependency was used

No application source changed — only package.json (overrides) and package-lock.json. brace-expansion is never imported directly by this repo. Consumers:

• node_modules/brace-expansion (1.1.18) ← minimatch@3 ← eslint (dev tooling / lint)
• node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion (2.1.4) ← TS lint tooling
• node_modules/@ts-morph/common/node_modules/brace-expansion (5.0.9) ← shadcn CLI

All are glob-pattern expansion paths in build/lint/CLI tooling, so runtime app behavior is not affected. Risk is limited to lint/build tooling, both of which were exercised above.

Special instructions for this PR — e.g. if it's a Stainless thing

The pins deliberately go past the minimum Dependabot-required versions (1.1.16 / 2.1.2): the npm advisory DB flags <=1.1.17 and 2.0.0 - 2.1.3 for the OOM advisories, so 1.1.18 / 2.1.4 are needed for npm audit to come back clean. These are patch-level bumps within each major.

The existing brace-expansion@5.0.6 override key was removed because the installed 5.x version had already moved past 5.0.6, making that key a no-op going forward; brace-expansion@5 is the durable form.

AFTER YOU MERGE

Nothing. Remaining oz-workspace Dependabot alerts (hono, ip-address, sharp, valibot, @hono/node-server) are out of scope here and will be handled in follow-up PRs.