Possible fix(deps): 15 vulnerable dependencies in package-lock.json

[begininvoke]

I think there may be a problem in package-lock.json around line 5337.

The installed version 1.1.15 of the npm package brace‑expansion is vulnerable to a DoS attack (CVE‑2026‑14257). The library’s expand() function only caps the number of generated strings, but it does not limit the length of each string. An attacker can craft a modest‑size input that produces many long strings, exhausting memory and crashing the Node.js process. This is a HIGH‑severity vulnerability because it can be triggered by any user‑controllable pattern (e.g., glob patterns in minimatch) and leads to an unrecoverable out‑of‑memory error. The fix is to upgrade to a version that introduces a maxLength option (default 4 000 000) which bounds total output size, or explicitly set a safe maxLength when calling expand().

Something like this might fix it:

```diff
--- a/package.json
+++ b/package.json
@@
   "dependencies": {
-    "brace-expansion": "1.1.15",
+    // Upgrade to a version that includes the maxLength mitigation.
+    // Any version >= 1.1.17 (or the newer 5.x line) is safe.
+    "brace-expansion": "^1.1.17",
     ...
   }
 }
```
After updating `package.json`, run:
```bash
npm install   # regenerates package-lock.json with the patched version
```
If the project invokes `expand()` directly, also add a defensive `maxLength` parameter:
```js
const brace = require('brace-expansion');

// Safe usage – limit total output length to 4 000 000 characters (default in patched versions)
const result = brace.expand(pattern, { max: 100000, maxLength: 4_000_000 });
```
Upgrading the dependency eliminates the underlying flaw, and setting `maxLength` provides an additional runtime safeguard for any legacy code that might still call the older API.

For reference: rule CVE-2026-14257. Rated high.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.