Possible fix(deps): 5 vulnerable dependencies in pnpm-lock.yaml

[begininvoke]

Spotted what might be an issue in pnpm-lock.yaml around line 1.

Vulnerability: Unbounded memory allocation in brace-expansion before 1.1.17/2.1.3/3.0.3/5.0.8. The expand() function lacks a global character limit on output strings, allowing crafted inputs to keep result counts low while multiplying individual string lengths. Impact: Rapid exhaustion of available RAM, triggering an uncatchable out-of-memory crash and complete service denial. Risk Level: HIGH due to minimal payload size, trivial exploitation via any user-supplied glob/bracket patterns, and severe availability impact.

Something like this might fix it:

diff --git a/package.json b/package.json
index 1234567..abcdefg 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
   "dependencies": {
-    "brace-expansion": "1.1.12",
+    "brace-expansion": "^1.1.17"
   }
 }

Apply fix: pnpm install

For reference: rule CVE-2026-14257. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.