chore(deps): bump brace-expansion from 5.0.6 to 5.0.9

[dependabot]

Bumps brace-expansion from 5.0.6 to 5.0.9.

Commits

• fbcf8ec 5.0.9
• f6f3939 test: cover dropping empties when only some prefixes are empty
• 688a99e Merge commit from fork
• c66e5f9 docs: make the maxLength example produce a non-empty result (#137)
• 473d3e9 Bump linkify-it from 5.0.1 to 5.0.2 (#128)
• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3645bea

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Risk: low. Approved this patch-level brace-expansion lockfile bump; Cursor Bugbot was not present on the PR. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[yakimoto]

Superseded by #53 — please close this rather than merging it. This PR clears nothing, and I measured that rather than inferring it.

brace-expansion has two live advisories. The alert that opened this PR is the older >= 3.0.0, < 5.0.7 (fix 5.0.7). A newer one — GHSA-mh99-v99m-4gvg, range <= 5.0.7, patched in 5.0.8 — landed after it, and 5.0.7 sits inside that range.

Pinning each version in the lockfile and running npm audit with dev scope included:

brace-expansion	total	high	still flagged?
5.0.6 (main)	3	2	yes
5.0.7 (this PR)	3	2	yes
5.0.8 (#53)	2	1	no

Merging this would close the alert cosmetically while leaving the vulnerability in the tree — the worst of both outcomes, because it also removes the signal that would prompt a real fix.

#53 goes to 5.0.8 and is verified by driving minimatch directly, not by reading the audit summary. Safe here because this repo is minimatch@10.2.5; it would not be safe on a minimatch@3 tree, which is the trap documented in wave-av/claude-workstation#554 and mapped across the fleet in wave-av/claude-workstation#562.

[greptile-apps]

PR author is in the excluded authors list.