Override brace-expansion to 2.1.4

[eschultink]

Summary

• Dependabot alert #49 is still open: brace-expansion 2.1.0 via minimatch is vulnerable to CVE-2026-14257 (and the 2.1.3 bypass GHSA-rgw5-rvv9-x895).
• Pin the transitive package to 2.1.4 with an npm override so it stays patched.

Fixes

• https://app.asana.com/1/27145998307022/project/1213810491708190/task/1217341522586026

Supersedes Dependabot PR #37 (same bump, plus an override).

Features

n/a

Change implications

• includes or requires infrastructure changes? (tag 'infra-change') no

Made with Cursor

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}