chore(deps): raise the brace-expansion floor to 5.0.9

[HarshMN2345]

What does this PR do?

bun audit --audit-level high (.github/workflows/tests.yml:24) is failing on every branch, so the build job is red repo-wide:

brace-expansion  >=4.0.0 <5.0.9
  eslint › @eslint/eslintrc › minimatch › brace-expansion
  @sentry/sveltekit › @sentry/vite-plugin › @sentry/bundler-plugin-core › glob › minimatch › brace-expansion
  high: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
1 vulnerabilities (1 high)

package.json already carries a brace-expansion override, pinned at >=5.0.8. GHSA-rgw5-rvv9-x895 widened the affected range to <5.0.9, so that floor stopped clearing the advisory and the lock stayed on the now-vulnerable 5.0.8. This raises the floor to >=5.0.9, matching the existing security-override pattern in that block.

All reachable paths are dev-only (eslint, typescript-eslint, @sentry/vite-plugin), so nothing ships to users — but the job is red, which blocks unrelated PRs.

Test Plan

 bun.lock     | 4 ++--
 package.json | 2 +-

Three lines: the pinned floor, and the resolved version plus its integrity hash.

• bun audit --audit-level high → exit 0, no vulnerabilities.
• bun install --dry-run --frozen-lockfile → exit 0, so the lock is still consistent with package.json.

Worth noting for reviewers: running bun install --lockfile-only to regenerate the lock silently dropped the integrity hashes from the three private-registry @appwrite.io/* entries (console, pink-svelte, pink-icons-svelte), presumably because pkg.vc was not authenticated locally. I discarded that and edited the two brace-expansion lines directly so those hashes are preserved — the diff above confirms nothing else moved. Anyone regenerating this lock without registry auth should watch for the same thing.

Related PRs and Issues

• Unblocks the build job on fix(messaging): show delete for a processing message #3145 and any other open PR.

[appwrite]

Console (appwrite/console)

Project ID: 688b7bf400350cbd60e9

Sites (1)

Site	Status	Logs	Preview	QR
console-stage 688b7cf6003b1842c9dc	Building	View Logs	Preview URL

Tip

Preview deployments create instant URLs for every branch and commit

[greptile-apps]

Greptile Summary

Raises the brace-expansion override floor from 5.0.8 to 5.0.9 to clear the updated security advisory and restore audit checks.

• Updates the dependency override consistently in package.json and bun.lock.
• Updates the locked brace-expansion version and integrity hash without changing other dependencies.

Confidence Score: 5/5

The PR appears safe to merge, with the manifest and lockfile consistently applying the patched dependency floor.

The override and sole locked brace-expansion resolution both use 5.0.9, and the existing minimatch dependency range accepts that version.

Important Files Changed

Filename	Overview
package.json	Raises the brace-expansion override floor to 5.0.9; the corresponding lockfile override and resolution are consistent.
bun.lock	Resolves brace-expansion 5.0.9 with its updated integrity hash while preserving compatible transitive dependency constraints.

_{Reviews (1): Last reviewed commit: "chore(deps): raise the brace-expansion f..." | Re-trigger Greptile}