From 4b6dcfcd02a274043bcab1bd8ce8134bb1c8e692 Mon Sep 17 00:00:00 2001
From: maziggy <mz@v8w.de>
Date: Wed, 30 Sep 2026 08:20:26 +0200
Subject: [PATCH] security(frontend): pin brace-expansion to 5.0.12+

Raise the brace-expansion override from ^5.0.9 to ^5.0.12. Earlier
versions can run out of stack on deeply nested brace groups and take
quadratic time on the {a},b} rewrite. brace-expansion is a dev-only
transitive dependency of eslint (through minimatch) and only expands
the fixed globs in eslint.config.js.
---
 frontend/package-lock.json | 6 +++---
 frontend/package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index e64b59e2b..eb25a448a 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -3142,9 +3142,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "dependencies": {
         "balanced-match": "^4.0.2"
diff --git a/frontend/package.json b/frontend/package.json
index 48f247bda..562653888 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -56,7 +56,7 @@
   },
   "overrides": {
     "minimatch": "^10.2.1",
-    "brace-expansion": "^5.0.9",
+    "brace-expansion": "^5.0.12",
     "js-yaml": "^5.4.1",
     "nanoid": "^3.3.18",
     "react-router": "7.18.2"