Possible fix(deps): 5 vulnerable dependencies in pnpm-lock.yaml

[begininvoke]

Spotted what might be an issue in pnpm-lock.yaml around line 1.

The brace-expansion package v1.1.13 contains a High-severity Denial of Service vulnerability. The expand() function fails to bound the cumulative length of generated strings, allowing attackers to craft inputs that cause unbounded memory allocation. Although the function limits the number of results, chaining multiple brace groups causes total memory to scale rapidly, triggering a fatal Out-Of-Memory crash. Impact: Complete application unavailability when processing malicious input. Risk Level: HIGH.

Something like this might fix it:

--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "your-project",
   "dependencies": {
-    "brace-expansion": "1.1.13"
+    "brace-expansion": "^1.1.17"
   }
 }

Apply this change and run `pnpm install` to regenerate the lockfile. If brace-expansion is a transitive dependency, configure a pnpm override instead:
--- a/package.json
+++ b/package.json
@@ ...
   "pnpm": {
+    "overrides": {
+      "brace-expansion": "^1.1.17"
+    }
+  }
 }

For reference: rule CVE-2026-14257. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.