fix(build): patch @isaacs/brace-expansion critical vulnerability

[WilliamBerryiii]

Description

Patched critical npm security vulnerability in @isaacs/brace-expansion (GHSA-7h2j-956f-4vf2) that was blocking CI pipelines. Upgraded transitive dependency from 5.0.0 to 5.0.1, resolving the Uncontrolled Resource Consumption (CWE-400) issue and unblocking security audit checks.

Related Issue(s)

Fixes #403

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

N/A - This is a dependency security fix, not an AI artifact contribution.

Testing

• Ran npm audit --audit-level=moderate to confirm 0 vulnerabilities after the fix
• Ran npm ls @isaacs/brace-expansion to verify version upgraded to 5.0.1
• Dependency chain verified: [email protected] → [email protected] → [email protected] → @isaacs/[email protected]

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

N/A - Not an AI artifact contribution.

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

This fix addresses the critical vulnerability GHSA-7h2j-956f-4vf2 that was causing CI pipeline failures due to npm audit --audit-level=moderate security checks. The vulnerability (CWE-400: Uncontrolled Resource Consumption) existed in @isaacs/[email protected] and was resolved by upgrading to 5.0.1 via npm audit fix.

🔒 - Generated by Copilot

[Copilot]

Copilot wasn't able to review any files in this pull request.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@isaacs/brace-expansion	5.0.1	Unknown	Unknown

Scanned Files

• package-lock.json

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.93%. Comparing base (1dd31ad) to head (d2edc91).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #404      +/-   ##
==========================================
- Coverage   60.96%   60.93%   -0.04%     
==========================================
  Files          19       19              
  Lines        3233     3233              
==========================================
- Hits         1971     1970       -1     
- Misses       1262     1263       +1     

Flag	Coverage Δ
pester	60.93% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[WilliamBerryiii]

@katriendg & @bindsi - can you review and merge this when you all get rolling for the day?

[katriendg]

Thanks for fixing