brace-expansion override ^5.0.8 -> ^5.0.9 (GHSA-rgw5-rvv9-x895, DoS).

5.0.8's maxLength cap was applied in combine(), where output is merged, but
    not to the two arrays built before it runs: comma alternatives each got their
    own full allowance and were concatenated with no running total, and padded
    sequences never consulted maxLength at all. So a ~25 KB pattern still OOMs the
    process -- fatally, past the reach of try/catch -- and a ~400 KB one blocks the
    event loop for over two minutes. 5.0.9 bounds both as they are built.

    Dev-only and transitive here: it reaches us as eslint -> minimatch@5 ->
    brace-expansion, the only input it sees is our own lint globs, and it is not in
    the shipped bundle. The ci.yml audit gate runs --omit=dev, so this never would
    have failed CI; it surfaced through Dependabot.

    The overrides floor is bumped alongside the lockfile so a clean install can't
    resolve back to the vulnerable 5.0.8.

frontend/package-lock.json

@@ -3173,9 +3173,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "dependencies": {
         "balanced-match": "^4.0.2"

frontend/package.json

@@ -48,7 +48,7 @@
   },
   "overrides": {
     "minimatch": "^10.2.1",
-    "brace-expansion": "^5.0.8",
+    "brace-expansion": "^5.0.9",
     "js-yaml": "^4.3.0",
     "react-router": "7.18.1"
   },