fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149)

[anupamme]

Summary

Upgrade brace-expansion from 5.0.2 to 5.0.7, 1.1.16, 2.1.2 to fix CVE-2026-13149.

Vulnerability

Field	Value
ID	CVE-2026-13149
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-13149
File	package-lock.json
Assessment	Likely exploitable

Description: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

Evidence

Scanner confirmation: trivy rule CVE-2026-13149 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• package.json
• package-lock.json

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[github-actions]

👋 Hi @anupamme, thanks for the pull request! A scan flagged a concern with it. Could you please take a look?

[pr-task-completion] This PR's body is missing [x] checks on the following tasks from the PR template.

• Addresses an existing open issue: fixes #000 (or is a trivial change)
• That issue was marked as status: accepting prs
• Steps in CONTRIBUTING.md were taken

Repositories often provide a set of tasks that pull request authors are expected to complete. Those tasks should be marked as completed with a [x] in the pull request description. Please complete those tasks and mark the checks as [x] completed.

🗺️ This message was posted automatically by OctoGuide: a bot for GitHub repository best practices.