chore(deps)(deps-dev): bump brace-expansion from 1.1.14 to 1.1.16

[dependabot]

Bumps brace-expansion from 1.1.14 to 1.1.16.

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• 2203f4f 1.1.15
• 0b09384 Backport v5.0.6 change to v1 (#111)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

Security review — PR #217

Verdict: No high-confidence vulnerabilities introduced by this diff.

This pull request is a dependency remediation: it updates package-lock.json only and bumps all resolved brace-expansion copies to patched releases (1.1.14 → 1.1.16 in nested dev trees; 5.0.6 → 5.0.8 at the top level). No application source, config, or workflow logic changes.

Threat-model checklist (diff-scoped)

Area	Result
Injection (SQL/command/template/path)	Not applicable — no runtime code changes
Authn/authz bypass	Not applicable
Secrets / token leakage	Not applicable
Deserialization, SSRF, XSS, CSRF	Not applicable
Supply chain	Remediation — addresses CVE-2026-13149 (DoS via exponential brace expansion)

Confirmed findings

None. The diff does not introduce exploitable behavior.

Remediation already present in this PR

All six brace-expansion lockfile entries now resolve to patched versions (1.1.16 or 5.0.8), which are the fixed releases for CVE-2026-13149. Merging this PR reduces prior DoS exposure in dev/build tooling (ESLint, rimraf, tmp, minimatch/glob consumers).

Residual risk / assumptions (informational, not blocking)

1. Runtime exposure is low for this repo. brace-expansion is transitive in dev/build tooling, not shipped to the static Astro site. Exploitation requires attacker-controlled strings reaching expand() (e.g. via glob/minimatch brace patterns). That path is not evident in production runtime for this portfolio.
2. Node engine metadata change. brace-expansion@5.0.8 declares node: "20 || >=22" (Node 18 removed). This is an operational compatibility note, not a security defect; confirm CI/dev environments meet that constraint.
3. CI format failure is unrelated. The Lint, format, type-check, audit job failed on Prettier checks in unrelated files, not on audit findings for brace-expansion.

Recommendation

Approve from a security perspective. Merge to complete the CVE remediation. No additional security-driven code changes are required in this PR.

  

_{Sent by Cursor Automation: Find vulnerabilities}