chore(deps): bump brace-expansion from 5.0.6 to 5.0.7

[dependabot]

Bumps brace-expansion from 5.0.6 to 5.0.7.

Commits

• b735ba6 5.0.7
• c7e33ec Merge commit from fork
• fa1786a Bump tar from 7.5.11 to 7.5.16 (#116)
• c16f1ec fix(package.json): use git+https instead of git+ssh for repository URL (#115)
• 196bbcc Bump ip-address from 10.1.0 to 10.2.0 (#104)
• eb18dd6 Update ci.yml (#107)
• a39928d Bump minimatch (#106)
• 7950ae3 ci: correct test workflow (#105)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Update brace-expansion from 5.0.6 to 5.0.7 to pull in upstream maintenance fixes and keep dependencies current. Lockfile-only change; no runtime impact expected.

^{Written for commit 3645bea. Summary will update on new commits.}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3645bea

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Risk: low. Approved this patch-level brace-expansion lockfile bump; Cursor Bugbot was not present on the PR. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[yakimoto]

Superseded by #53 — please close this rather than merging it. This PR clears nothing, and I measured that rather than inferring it.

brace-expansion has two live advisories. The alert that opened this PR is the older >= 3.0.0, < 5.0.7 (fix 5.0.7). A newer one — GHSA-mh99-v99m-4gvg, range <= 5.0.7, patched in 5.0.8 — landed after it, and 5.0.7 sits inside that range.

Pinning each version in the lockfile and running npm audit with dev scope included:

brace-expansion	total	high	still flagged?
5.0.6 (main)	3	2	yes
5.0.7 (this PR)	3	2	yes
5.0.8 (#53)	2	1	no

Merging this would close the alert cosmetically while leaving the vulnerability in the tree — the worst of both outcomes, because it also removes the signal that would prompt a real fix.

#53 goes to 5.0.8 and is verified by driving minimatch directly, not by reading the audit summary. Safe here because this repo is minimatch@10.2.5; it would not be safe on a minimatch@3 tree, which is the trap documented in wave-av/claude-workstation#554 and mapped across the fleet in wave-av/claude-workstation#562.