chore(deps): bump brace-expansion from 5.0.7 to 5.0.9

[dependabot]

Bumps brace-expansion from 5.0.7 to 5.0.9.

Commits

• fbcf8ec 5.0.9
• f6f3939 test: cover dropping empties when only some prefixes are empty
• 688a99e Merge commit from fork
• c66e5f9 docs: make the maxLength example produce a non-empty result (#137)
• 473d3e9 Bump linkify-it from 5.0.1 to 5.0.2 (#128)
• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Indirect dependency patch in the lockfile only; no application code changes, and the repo already targets Node 22+.

Overview
Updates the lockfile so transitive brace-expansion (via minimatch) moves from 5.0.7 to 5.0.9. No direct package.json dependency changes.

Upstream 5.0.8–5.0.9 includes security-related merges, extra tests, and doc fixes; the resolved package’s Node engine range is now 20 || >=22 (dropping 18), which aligns with this repo’s >=22.8.0 engine requirement.

^{Reviewed by Cursor Bugbot for commit 8f2d8d7. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bump brace-expansion dependency from 5.0.7 to 5.0.9

Updates brace-expansion in package-lock.json to version 5.0.9.

^{Macroscope summarized 8f2d8d7.}

[imMamdouhaboammar]

Reviewed the lockfile-only change. The diff is limited to brace-expansion 5.0.7 -> 5.0.9 plus its integrity and Node engine metadata, the target's Node range remains compatible with this repository, the PR is currently mergeable, and its workflow run is green. No blocking issues found.

[snimu]

Folded into the consolidated dependency update #632 (brace-expansion 5.0.9); see that PR for validation. Closing in its favor.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.