Bump brace-expansion from 5.0.5 to 5.0.9

[dependabot]

Bumps brace-expansion from 5.0.5 to 5.0.9.

Commits

• fbcf8ec 5.0.9
• f6f3939 test: cover dropping empties when only some prefixes are empty
• 688a99e Merge commit from fork
• c66e5f9 docs: make the maxLength example produce a non-empty result (#137)
• 473d3e9 Bump linkify-it from 5.0.1 to 5.0.2 (#128)
• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[softhack007]

@coderabbitai where is brace-expansion used in our source code? Would updating to brace-expansion 5.0.9 cause compatibility problems?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Candidate manifests and lockfiles =='
fd -HI -t f '^(package\.json|package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' . \
  -E .git -E node_modules | sort

printf '%s\n' '== All brace-expansion references =='
rg -n -i -C 3 \
  -g 'package.json' -g 'package-lock.json' -g 'npm-shrinkwrap.json' \
  -g 'yarn.lock' -g 'pnpm-lock.yaml' -g '*.{js,cjs,mjs,ts,cts,mts,json}' \
  '(?<![[:alnum:]_-])brace-expansion(?![[:alnum:]_-])' . \
  -g '!**/node_modules/**' -g '!**/.git/**' || true

printf '%s\n' '== Direct JavaScript/TypeScript module references =='
rg -n -P -C 3 \
  '(?:from\s*["'\'']brace-expansion["'\'']|require\s*\(\s*["'\'']brace-expansion["'\'']\s*\)|import\s*\(\s*["'\'']brace-expansion["'\'']\s*\))' \
  . -g '*.{js,cjs,mjs,ts,cts,mts}' -g '!**/node_modules/**' -g '!**/.git/**' || true

Length of output: 1435

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== package.json dependency declarations =='
ast-grep outline package.json --view expanded || true
rg -n -P -C 4 '"(brace-expansion|dependencies|devDependencies|optionalDependencies|peerDependencies)"\s*:' package.json || true

printf '%s\n' '== package-lock.json brace-expansion entries =='
rg -n -P -C 8 '"node_modules/brace-expansion"|"brace-expansion"\s*:' package-lock.json || true

printf '%s\n' '== All repository references (PCRE2) =='
rg --pcre2 -n -i -C 3 \
  -g 'package.json' -g 'package-lock.json' -g 'npm-shrinkwrap.json' \
  -g 'yarn.lock' -g 'pnpm-lock.yaml' -g '*.{js,cjs,mjs,ts,cts,mts,json}' \
  '(?<![[:alnum:]_-])brace-expansion(?![[:alnum:]_-])' . \
  -g '!**/node_modules/**' -g '!**/.git/**' || true

printf '%s\n' '== Files changed by this PR =='
git diff --find-renames --stat HEAD^ HEAD
git diff --find-renames -- package.json package-lock.json

Length of output: 3891

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Exact PR lockfile diff =='
git diff --unified=20 HEAD^ HEAD -- package-lock.json

workdir="$(mktemp -d)"
trap 'rm -rf "$workdir"' EXIT

for version in 5.0.5 5.0.9; do
  archive="$workdir/brace-expansion-$version.tgz"
  curl --fail --silent --show-error --location \
    "https://registry.npmjs.org/brace-expansion/-/brace-expansion-$version.tgz" \
    --output "$archive"
  mkdir "$workdir/$version"
  tar -xzf "$archive" -C "$workdir/$version" --strip-components=1
done

printf '%s\n' '== Published package metadata diff =='
diff -u "$workdir/5.0.5/package.json" "$workdir/5.0.9/package.json" || true

printf '%s\n' '== Published implementation diff =='
diff -ru \
  --exclude=package.json --exclude=README.md --exclude=LICENSE \
  "$workdir/5.0.5" "$workdir/5.0.9" || true

printf '%s\n' '== Relevant 5.0.9 exported API and runtime constraints =='
sed -n '1,220p' "$workdir/5.0.9/package.json"

Length of output: 104996

---

@softhack007 brace-expansion is not used directly by WLED source code.

It exists only in package-lock.json as a transitive dependency:

WLED package.json
  └─ minimatch 10.2.4
       └─ brace-expansion ^5.0.2
            └─ resolved as 5.0.9

minimatch uses it to expand brace patterns in glob matching. This PR changes only package-lock.json.

The update has a low runtime compatibility risk for WLED. Version 5.0.9 keeps the same public expand() API. It adds a maxLength option and a default 4,000,000-character output limit. This limit prevents memory exhaustion and stack overflow from extremely large or deeply chained brace expressions. Normal glob patterns are not affected.

There is one compatibility concern: brace-expansion 5.0.9 declares Node.js support as 20 || >=22. Version 5.0.5 also supported Node.js 18. If a developer or CI job uses Node.js 18 with engine-strict, npm install can fail. Without engine-strict, npm will normally emit an engine warning.

I recommend merging this update if supported development and CI environments use Node.js 20 or later. If Node.js 18 remains supported, keep brace-expansion at 5.0.5 or update the Node.js baseline first.

_{You are interacting with an AI system.}

[softhack007]

@coderabbitai please find the source code files which use functions from the minimatch package.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Candidate JavaScript and TypeScript source files =='
fd -HI -t f -e js -e cjs -e mjs -e ts -e cts -e mts . \
  -E .git -E node_modules -E dist -E build \
  | sort

printf '%s\n' '== Source file outline =='
fd -HI -t f -e js -e cjs -e mjs -e ts -e cts -e mts . \
  -E .git -E node_modules -E dist -E build \
  -x ast-grep outline {} --view compact 2>/dev/null || true

printf '%s\n' '== Direct minimatch module imports =='
rg -n -P -C 4 \
  '(?:import\s+(?:[\w*$\s{},]+\s+from\s+)?["'\'']minimatch["'\'']|require\s*\(\s*["'\'']minimatch["'\'']\s*\)|import\s*\(\s*["'\'']minimatch["'\'']\s*\))' \
  . \
  -g '*.{js,cjs,mjs,ts,cts,mts}' \
  -g '!**/node_modules/**' -g '!**/.git/**' -g '!**/dist/**' -g '!**/build/**' || true

printf '%s\n' '== Package and lockfile references =='
rg -n -P -C 3 '"minimatch"\s*:|"node_modules/minimatch"' \
  . \
  -g 'package.json' -g 'package-lock.json' -g 'npm-shrinkwrap.json' \
  -g 'yarn.lock' -g 'pnpm-lock.yaml' \
  -g '!**/node_modules/**' -g '!**/.git/**' || true

Length of output: 2537

---

@softhack007 No WLED source code file directly uses minimatch.

I searched all repository JavaScript and TypeScript source files for:

• ES module imports from "minimatch".
• CommonJS require("minimatch").
• Dynamic import("minimatch").

The search found no matches.

minimatch exists only as a transitive dependency in package-lock.json at Line 525. The lockfile references version 10.2.4. It is used by a development tool dependency chain, not by WLED firmware or web UI source code.

_{You are interacting with an AI system.}