diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9465ea3..eed5fed 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,7 +12,7 @@ overrides:
   picomatch: '>=4.0.4'
   yaml: '>=2.8.3'
   postcss: '>=8.5.18'
-  brace-expansion@2: '>=2.1.3 <3'
+  brace-expansion@2: '>=2.1.3 <6'
   brace-expansion@5: '>=5.0.8'
   js-yaml: '>=4.3.0 <5'
   sharp: '>=0.35.0'
@@ -2260,10 +2260,6 @@ packages:
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
-  picomatch@4.0.4:
-    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
-    engines: {node: '>=12'}
-
   picomatch@4.0.7:
     resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
     engines: {node: '>=12'}
@@ -3848,7 +3844,7 @@ snapshots:
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
-      tinyrainbow: 3.1.0
+      tinyrainbow: 3.1.1
 
   '@vitest/pretty-format@4.1.9':
     dependencies:
@@ -3872,7 +3868,7 @@ snapshots:
     dependencies:
       '@vitest/pretty-format': 4.1.11
       convert-source-map: 2.0.0
-      tinyrainbow: 3.1.0
+      tinyrainbow: 3.1.1
 
   '@vitest/utils@4.1.9':
     dependencies:
@@ -4284,9 +4280,9 @@ snapshots:
     dependencies:
       fast-string-width: 3.0.2
 
-  fdir@6.5.0(picomatch@4.0.4):
+  fdir@6.5.0(picomatch@4.0.7):
     optionalDependencies:
-      picomatch: 4.0.4
+      picomatch: 4.0.7
 
   file-entry-cache@8.0.0:
     dependencies:
@@ -4588,8 +4584,6 @@ snapshots:
 
   picocolors@1.1.1: {}
 
-  picomatch@4.0.4: {}
-
   picomatch@4.0.7: {}
 
   postcss@8.5.23:
@@ -4909,8 +4903,8 @@ snapshots:
 
   tinyglobby@0.2.17:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.4)
-      picomatch: 4.0.4
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7
 
   tinyrainbow@3.1.0: {}
 
@@ -4978,7 +4972,7 @@ snapshots:
   vite@8.1.0(@types/node@25.9.4)(esbuild@0.28.1)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.32.0
-      picomatch: 4.0.4
+      picomatch: 4.0.7
       postcss: 8.5.23
       rolldown: 1.1.3
       tinyglobby: 0.2.17
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5b3cab9..a8747a3 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -15,7 +15,8 @@ minimumReleaseAge: 1440
 # fix. Version-scoped so future releases of the package still age-gate.
 # Safe to delete from 2026-07-30 (2.1.3 clears the window 2026-07-29 ~10:17 UTC).
 minimumReleaseAgeExclude:
-  - 'brace-expansion@2.1.3'
+  # Renovate security update: brace-expansion@5.0.12
+  - 'brace-expansion@2.1.3 || 5.0.12'
   # Renovate security update: pnpm@11.11.0
   - pnpm@11.11.0
   # Renovate security update: vitest@4.1.11
@@ -72,7 +73,7 @@ overrides:
   picomatch: '>=4.0.4'
   yaml: '>=2.8.3'
   postcss: '>=8.5.18' # GHSA-r28c-9q8g-f849
-  'brace-expansion@2': '>=2.1.3 <3' # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg 2.x backport
+  'brace-expansion@2': '>=2.1.3 <6' # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg 2.x backport
   'brace-expansion@5': '>=5.0.8' # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg
   js-yaml: '>=4.3.0 <5' # GHSA-52cp-r559-cp3m
   sharp: '>=0.35.0' # GHSA-f88m-g3jw-g9cj (build denied above; pin is belt+braces)