Update package-lock.json using npm audit fix as security update

[PeterDaveHello]

Summary

• Update the transitive brace-expansion 1.x and 2.x lockfile entries to patched patch releases.
• Keep the security update lockfile-only and avoid npm audit fix --force, which may introduce breaking dependency changes.

Validation

• npm test — 54 passed
• npm run lint — passed
• npm run build — passed
• npm run pretty — passed
• npm ci --ignore-scripts --dry-run — passed
• Local multi-reviewer loop — no actionable findings

The full audit still reports unrelated existing toolchain/transitive advisories that require npm audit fix --force; the runtime-only audit completed without high-severity findings.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[qodo-code-review]

PR Summary by Qodo

Patch transitive brace-expansion versions via lockfile-only npm audit fix

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Update lockfile-only transitive brace-expansion entries to patched releases.
• Avoid npm audit fix --force to prevent potentially breaking dependency shifts.
• Preserve existing install/test behavior while addressing known advisories.

Diagram

graph TD
  Dev[Developer] --> Audit["npm audit fix"] --> Lock["package-lock.json"] --> B1["brace-expansion 1.1.18"]
  Lock --> B2["brace-expansion 2.1.4"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Upgrade parent packages to lift transitive brace-expansion

• ➕ May reduce duplicated transitive versions (1.x and 2.x) over time
• ➕ Can address additional advisories through normal semver upgrades
• ➖ Higher risk of behavior changes vs lockfile-only patching
• ➖ May require code/test updates and broader review

2. Use npm overrides/resolutions to force patched versions

• ➕ Explicitly enforces patched transitive versions across the tree
• ➕ Can be applied even when upstream packages lag
• ➖ May mask upstream dependency issues and complicate future upgrades
• ➖ Requires ongoing maintenance and can surprise contributors

3. Automate via Dependabot/Renovate lockfile maintenance

• ➕ Continuous, low-effort patch flow for transitive vulnerabilities
• ➕ Standardized PR metadata and scheduling
• ➖ Adds operational overhead (bot config/noise management)
• ➖ May still require occasional manual intervention for complex advisories

Recommendation: The current lockfile-only npm audit fix approach is the best fit for a low-risk security patch: it updates only the affected transitive resolutions without introducing potentially breaking upgrades that --force could cause. Consider automation (Dependabot/Renovate) if these lockfile-only security refreshes are frequent, but for a targeted remediation this PR’s strategy is appropriate.

Files changed (1) +6 / -6

Other (1) +6 / -6

package-lock.jsonBump transitive brace-expansion 1.x and 2.x to patched releases +6/-6

Bump transitive brace-expansion 1.x and 2.x to patched releases

• Updates lockfile resolutions for brace-expansion from 1.1.16 → 1.1.18 and 2.1.2 → 2.1.4 (nested under readdir-glob). This is a lockfile-only security remediation intended to avoid broader dependency churn from forced audit fixes.

package-lock.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 6 rules

1. Long integrity line added 📘 Rule violation ⚙ Maintainability

Description

package-lock.json contains modified integrity line(s) whose length exceeds 100 characters. This
violates the repository line-length compliance requirement and makes diffs harder to review.

Code

package-lock.json[4315]

+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",

Evidence

PR Compliance ID 2261946 requires that no non-comment, non-whitespace line exceed 100 characters,
and the cited modified integrity line(s) in package-lock.json are well over that limit due to
the long sha512 hash string, demonstrating a direct violation of the rule.

Rule 2261946: Limit source line length to 100 characters
package-lock.json[4315-4315]
package-lock.json[12681-12681]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A modified line in `package-lock.json` exceeds the 100-character line limit.

## Issue Context
`package-lock.json` includes long `integrity` hashes that cannot be meaningfully wrapped, so enforcing a strict 100-character limit on this file causes unavoidable violations.

## Fix Focus Areas
- package-lock.json[4315-4315]
- package-lock.json[12681-12681]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ca67985-11a7-4096-ae63-17516aa998bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.