chore(security): patch 1 Dependabot alert

[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

1 fixed, 0 ignored, 4 deferred, 0 security pins added, 0 security pins removed, 0 could-not-auto-fix. | label: 🔒 security applied

Fixed

Alert	Gem	Ecosystem	From → To	Severity	What was bumped
#89	brace-expansion	npm	5.0.6 → 5.0.9	high	Added root resolutions entry "brace-expansion": "^5.0.7" in package.json; parent minimatch@^10.x requires ^5.0.5, resolution pulls the latest 5.x (5.0.9).

Ignored

None.

Deferred

Skipped by the < 7-day age gate (will be handled by the next scheduled run):

• #94 — brace-expansion (npm), high, <= 5.0.7 (patched 5.0.8). Note: incidentally already resolved by this PR's bump to 5.0.9, but listed here because the alert itself was opened < 7 days ago.
• #93 — tar (npm), medium, <= 7.5.20 (patched 7.5.21).
• #92 — fast-uri (npm), high, >= 3.0.0, <= 3.1.3 (patched 3.1.4).
• #91 — fast-uri (npm), high, >= 3.0.0, < 3.1.3 (patched 3.1.3).

Risks

• brace-expansion 5.0.6 → 5.0.9: patch-level bump within the 5.x line. Upstream 5.0.7/5.0.8/5.0.9 are all bug-fix/security releases (5.0.7 fixes the DoS in expand() covered by feat: add lazy join decorator to improve performance #89; 5.0.8 extends the same bound; 5.0.9 is a further patch on that fix). No API changes. No behavior change beyond the patched vuln for callers that aren't already blowing memory.

Manual testing

Covered by CI.

Validation

✅ CI green (Actions + commit statuses; app-based checks not monitored)

Review checklist

Fixes to verify — tick once you have confirmed the bump landed:

• #89 — brace-expansion

[christophebrun-forest]

Check done