[wlabu]

See:

• https://www.cve.org/CVERecord?id=CVE-2026-93687
• https://security.snyk.io/vuln/SNYK-JS-BRACES-19963945

The underlying problem is the the braces package.
The dependency tree is:

react-strict-dom@0.0.55
  > postcss-react-strict-dom@0.0.55
    > fast-glob@3.3.3
      > micromatch@4.0.8
        > braces@3.0.3

Since braces is no longer being maintained, and the Issue for this CVE has been "locked as spam", it feels like this problem won't be addressed in braces, micromatch, or fast-glob.

So, this PR replaces fast-glob with tinyglobby (npm), a drop-in replacement with a (much) smaller dependency chain.

---

Notes:

• the unrelated lock file changes are npm removing 2 stale workspace projects.
• the expandDirectories addition is because of the migration:

[github-actions]

workflow: benchmarks/size

Comparison of minified (terser) and compressed (brotli) size results, measured in bytes. Smaller is better.

Results	Base	Patch	Ratio
react-strict-dom/dist/web/index.js
· compressed	3,251	3,251	1.00
· minified	10,375	10,375	1.00
react-strict-dom/dist/web/runtime.js
· compressed	1,645	1,645	1.00
· minified	4,131	4,131	1.00
react-strict-dom/dist/native/index.js
· compressed	16,850	16,850	1.00
· minified	65,487	65,487	1.00
react-strict-animated/dist/web/index.js
· compressed	6,861	6,861	1.00
· minified	23,486	23,486	1.00
react-strict-animated/dist/native/index.js
· compressed	797	797	1.00
· minified	2,518	2,518	1.00

[github-actions]

workflow: benchmarks/perf (native)

Comparison of performance test results, measured in operations per second. Larger is better.

Results	Base	Patch	Ratio
css.create
· small	1,420,826	1,467,903	1.03	+
· small with units	641,669	637,596	0.99	-
· small with variables	874,748	877,391	1.00	+
· several small	453,386	461,464	1.02	+
· large	271,030	271,077	1.00	+
· large with polyfills	204,696	204,734	1.00	+
· complex	138,956	140,163	1.01	+
· unsupported	288,113	289,855	1.01	+
css.createTheme
· simple theme	325,363	328,314	1.01	+
· polyfill theme	309,461	312,990	1.01	+

[wlabu]

any chance to get this fix in, please?

[wlabu]

Closing this since the advisory has been withdrawn.