fix: update brace-expansion to resolve CVE-2026-102277

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: brace-expansion 5.0.8 -> 5.0.12 (lockfile only; transitive dev dep via eslint/minimatch)
• Advisory: GHSA-q2hr-2g5m-vwhr (CVE-2026-102277)
• Dependabot alert: https://github.com/warpdotdev/oz-agent-action/security/dependabot/53
• Verification: npm ci, npm audit (brace-expansion no longer reported), npm run lint, npm test (27 passed)

Highlight the risky code / where the dependency was used

Dev-only (eslint -> minimatch). Not in the dist/ bundle; no runtime impact.

Special instructions for this PR — e.g. if it's a Stainless thing

None. Existing overrides (brace-expansion >=1.1.16) already allows the patched version; only package-lock.json changed.

AFTER YOU MERGE

Nothing.

[independabot-soc2]

This PR was generated with Warp.

Comment @warp-agent on this PR to send it follow-up work.

  View origin