chore(deps-dev): bump brace-expansion from 5.0.8 to 5.0.9

[dependabot]

Bumps brace-expansion from 5.0.8 to 5.0.9.

Commits

• fbcf8ec 5.0.9
• f6f3939 test: cover dropping empties when only some prefixes are empty
• 688a99e Merge commit from fork
• c66e5f9 docs: make the maxLength example produce a non-empty result (#137)
• 473d3e9 Bump linkify-it from 5.0.1 to 5.0.2 (#128)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dhensby]

Dependabot Review: brace-expansion 5.0.12

Package Changes

Package	Change	Bump	Dependency type
brace-expansion	5.0.8 → 5.0.12	patch	transitive (dev)

Supply-Chain Verification ✅

Every package version that is new in package-lock.json (compared with merge-base 5f1e81e):

Package	Version	Scope	npm publish (UTC)	Publisher	Evidence	Result
brace-expansion	5.0.12	dev	2026-09-14 21:59:00Z	juliangruber	No provenance (maintainer publish). Tag v5.0.12 (f3410159d7). Tarball: 3 files byte-identical to the tag. dist/ equals a tsc 5.9.2 build of the tag's src/index.ts.	✅

• The resolved URL and integrity hash of each new lockfile entry match the registry metadata.
• All other packages resolve the same dependency versions as before.
• No new entry has an install script.
• The PR title and the commit metadata name 5.0.9. The lockfile changes node_modules/brace-expansion from 5.0.8 to 5.0.12. The only 5.0.9 copy is node_modules/npm/node_modules/brace-expansion, which is bundled inside npm and does not change. This review uses the lockfile versions.
• The diff changes only package-lock.json. The only commit is by dependabot[bot].

CI Status ✅

All 6 checks pass on head 1ab7a50: Lint commits, Lint code, Run tests (20.x), Run tests (22.x), Run tests (24.x), Test coverage. Skipped: Release.

Breaking Changes / Impact

• Security fix: GHSA-6j4f-fj2g-mc7p (high), GHSA-qhr7-859c-m2p7 (high) and GHSA-q2hr-2g5m-vwhr (medium). All three are denial-of-service bugs in brace expansion. It is a transitive dependency of minimatch. Our code does not call it directly.

Approved. All new versions match the registry and their upstream source. The diff changes only dependency files. CI is green.