fix(security): clear high-severity Dependabot alert (brace-expansion)

[keyserfaty]

What

Clears the single open high-severity Dependabot alert on this repo: transitive brace-expansion 5.0.3 (dev chain) → 5.0.8 via an overrides floor (^5.0.7), lockfile-only refresh.

Part of the org-wide high-severity Dependabot pass (see tiny-agent-company/tiny-agent-company#1892). Do not merge without review.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[greptile-apps]

Greptile Summary

Updates the development dependency graph to remediate the vulnerable brace-expansion release.

• Adds an npm override requiring brace-expansion ^5.0.7.
• Refreshes the lockfile to pin brace-expansion 5.0.8 with its integrity hash.
• Reformats the package manifests without otherwise changing declared dependencies.

Confidence Score: 5/5

The PR appears safe to merge because the override and lockfile consistently select the remediated dependency version.

The only substantive manifest change is reflected by a concrete brace-expansion 5.0.8 lockfile entry with registry resolution and integrity metadata, and no changed-code-triggered failure remains.

T-Rex Logs

What T-Rex did

• Validated that brace-expansion moved from 5.0.3 to 5.0.8 and traced the dependency chain from npm through sucrase to glob and minimatch.
• Ran a dry-run install and a real install; both exited with code 0.
• Executed an after-worktree scan that rejected any installed brace-expansion version other than 5.0.8.
• Reviewed the package-lock-only resolution and noted brace-expansion remained at 5.0.8, with npm 11 proposing lock alignment for unrelated packages but not counted as a product finding.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
package.json	Adds the intended npm override; the remaining diff is formatting-only.
package-lock.json	Resolves the overridden transitive dependency to brace-expansion 5.0.8 and removes incidental unused peer-package entries.

_{Reviews (1): Last reviewed commit: "fix(security): brace-expansion >=5.0.7 o..." | Re-trigger Greptile}