copilot-swe-agent[bot]andGitHub 4ff1ddf5d7 fix: eliminate remaining brace-expansion vulnerabilities and update license cache ...

## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
  root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
  of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
  minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
  natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
  from the jest coverage instrumentation path

`npm audit --audit-level=high` now reports 0 vulnerabilities.

## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml

Rebuild dist artifacts to include updated brace-expansion.

2026-07-28 10:24:34 +00:00

..

cache-save

fix: eliminate remaining brace-expansion vulnerabilities and update license cache

2026-07-28 10:24:34 +00:00

setup

fix: eliminate remaining brace-expansion vulnerabilities and update license cache

2026-07-28 10:24:34 +00:00