From 8e2ad42352bd9dceaaf501c6deb8268fb81c33c6 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:49:24 -0600
Subject: [PATCH] Bump brace-expansion to 1.1.21 to remediate
 GHSA-q2hr-2g5m-vwhr

brace-expansion is a dev-only transitive dependency (via eslint).
Add an explicit override floor of >=1.1.21 <2 so the patched release
is required, staying inside the 1.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7a2507e5-5868-45bf-aa18-07670377dbb1
---
 package-lock.json | 15 ++++++++-------
 package.json      |  1 +
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 128caa4265..400a11de0e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -127,10 +127,11 @@
       "dev": true
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
@@ -1070,9 +1071,9 @@
       "dev": true
     },
     "brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "requires": {
         "balanced-match": "^1.0.0",
@@ -1491,7 +1492,7 @@
       "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "requires": {
-        "brace-expansion": "^1.1.7"
+        "brace-expansion": ">=1.1.21 <2"
       }
     },
     "ms": {
diff --git a/package.json b/package.json
index 2552335e0a..6b46470439 100644
--- a/package.json
+++ b/package.json
@@ -19,6 +19,7 @@
     "eslint-plugin-json": "^3.1.0"
   },
   "overrides": {
+    "brace-expansion": ">=1.1.21 <2",
     "lodash": ">=4.18.0",
     "js-yaml": "^4.3.2"
   }