[dcavalcante]

Description

Updates the transitive brace-expansion versions in package-lock.json to resolve vulnerabilities reported by npm audit.

No direct dependencies or dependency ranges are changed. The existing ranges already allow the patched versions, so this is a lockfile-only update.

Updated versions:

• brace-expansion 5.0.9 → 5.0.12
• nested brace-expansion 2.1.4 → 2.1.7

The affected entries are pulled in through minimatch, glob, and @npmcli/map-workspaces.

npm audit

Before the update, npm audit reported:

Original npm audit output

# npm audit report

brace-expansion  2.0.0 - 2.1.6 || 4.0.0 - 5.0.11
Severity: high

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
https://github.com/advisories/GHSA-q2hr-2g5m-vwhr

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
https://github.com/advisories/GHSA-qhr7-859c-m2p7

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
https://github.com/advisories/GHSA-6j4f-fj2g-mc7p

fix available via `npm audit fix`

node_modules/@npmcli/map-workspaces/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion

1 high severity vulnerability

To address all issues, run:

  npm audit fix

After updating the lockfile:

found 0 vulnerabilities

Validation

Verified locally with:

npm ci
npm audit
npm run lint
npm run format:check
npm run build
npm run test:e2e

npm audit reports no vulnerabilities and all 20 end-to-end tests pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nodejs-learn	Ready	Preview	Oct 1, 2026 12:17am UTC

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

👋 Codeowner Review Request

The following codeowners have been identified for the changed files:

Team reviewers: @nodejs/nodejs-website

Please review the changes when you have a chance. Thank you! 🙏

[ovflowd]

Thanks @dcavalcante but we handle dependency updates via Dependabot. So these should/will be picked up by it eventually. We tend to not accept package update PRs for security reasons 🙇

[dcavalcante]

Thanks @dcavalcante but we handle dependency updates via Dependabot. So these should/will be picked up by it eventually. We tend to not accept package update PRs for security reasons 🙇

no worries @ovflowd! it just popped up while I was working on the repo, so I sent it along..