fix: upgrade brace-expansion to 5.0.5 (CVE-2026-33750)

[jdalton]

Summary

• Upgrades brace-expansion from 2.0.2 to 5.0.5 via pnpm catalog override
• Fixes CVE-2026-33750: zero-step sequence ({1..2..0}) causes infinite loop, process hang, and ~1.9 GB memory allocation
• Resolves https://github.com/SocketDev/socket-cli/security/dependabot/121

Test plan

• All 5157 unit tests pass
• Lint and typecheck pass
• Verified minimatch works correctly with brace-expansion v5

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk dependency bump primarily to address a known DoS/infinite-loop vulnerability; main potential impact is subtle glob/brace-matching behavior changes via minimatch and its transitive deps.

Overview
Upgrades brace-expansion to 5.0.5 via pnpm catalog/overrides to address CVE-related hang/memory blowup scenarios.

Regenerates pnpm-lock.yaml accordingly, updating transitive resolution (notably balanced-match and minimatch’s brace-expansion dependency) to align with the new version.

^{Written by Cursor Bugbot for commit 77b71fb. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​brace-expansion@​5.0.5

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​brace-expansion@​2.0.2 ⏵ 5.0.5		+2	-2	+3

View full report