deps: move brace-expansion to 5.0.9 (GHSA-rgw5-rvv9-x895)

[bdelanghe]

Closes #17.

Option 1 from the issue — the lockfile moved. No osv-scanner.toml, and .github/workflows/deps.yml is untouched.

What moved

Exactly one entry in deno.lock, one file, two lines:

-    "brace-expansion@5.0.8": {
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+    "brace-expansion@5.0.9": {
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",

before: brace-expansion@5.0.8 → after: brace-expansion@5.0.9

The integrity hash matches the value published on the npm registry for 5.0.9.

Why no manifest change was needed

The package is transitive — ts-morph@28 → @ts-morph/common@0.29.0 → minimatch@10.2.6 → brace-expansion — and deno.json pins only ts-morph@^28, so there is no manifest edit to make.

Nothing upstream constrained the bump: minimatch@10.2.6 declares brace-expansion: "^5.0.8", and 5.0.9 satisfies that range. brace-expansion@5.0.9 requires balanced-match ^4.0.2, already satisfied by the balanced-match@4.0.4 in the lock. So ts-morph@28 did not hold this back, and no direct dependency version changed.

Re-resolving the lock left every other resolved version untouched — the diff against the previous lock is only the two lines above.

Verification

Full ci.yml equivalent, run locally on deno 2.9.5:

step	result
deno task check	pass — checked mod.ts, cli.ts
deno lint	pass — checked 11 files
deno fmt --check	pass — checked 11 files
deno task test	pass — 7 passed, 0 failed
deno task drift check --entry mod.ts --golden .drift/surface.json	pass — "ok": true, golden: 21 symbols; live: 21 symbols
npx jsr publish --dry-run	pass — dry run complete, 12 files

The dogfood gate holds at 21/21 symbols, unchanged.

That the advisory no longer applies

Checked against OSV directly, per package version:

• brace-expansion@5.0.8 → GHSA-rgw5-rvv9-x895
• brace-expansion@5.0.9 → no vulnerabilities

And re-run through osv-scanner 2.5.0 the way the lane does it — deno.lock converted to a CycloneDX SBOM, since osv-scanner has no native deno.lock extractor. Both the before and after locks were scanned with the identical harness, so the clean result is a comparison and not the scan vouching for itself:

before (control) — reproduces the red exactly, exit 1:

Total 1 package affected by 1 known vulnerability (0 Critical, 1 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
1 vulnerability can be fixed.

| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE         | VERSION | FIXED VERSION |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion | 5.0.8   | 5.0.9         |

after — exit 0:

Scanned after.cdx.json file and found 11 packages

No issues found

All 11 npm packages in the lock are clean, not just brace-expansion.

Blast radius

This unblocks the merge gate repo-wide. It is currently holding #16 (fix(release): attach the binaries before the release is published), which is otherwise green — deno, version / version-check, add and CodeQL all pass there, and osv / osv-scan is the only failing check.

Worth noting for follow-up, not fixed here: .github/dependabot.yml runs the github-actions ecosystem only, so nothing sweeps the npm/JSR side automatically. deps.yml rescans weekly (Tuesdays), so a future transitive advisory will surface the same way — red on a lane that nothing bumps.

---

Generated by Claude Code