fix(security): resolve new high npm audit findings (brace-expansion, shell-quote)

[marcelfolaron]

Why

Two high advisories were published upstream after #3667 merged, so the npm audit --audit-level=high gate is red repo-wide again:

• brace-expansion — GHSA-3jxr-9vmj-r5cp, DoS via exponential-time expansion (transitive under glob / @sentry tooling)
• shell-quote — GHSA-395f-4hp3-45gv, quadratic-complexity DoS in parse()

Both are build-chain dev dependencies; no runtime exposure.

What

Lockfile-only in-range refresh via npm audit fix (15 changed lines). No package.json changes.

Verification

• npm audit --audit-level=high exits 0
• npx mix compiles cleanly

Note: the audit gate is time-sensitive — new advisories re-red it without any code change (this is the second such PR in three days). If it keeps recurring, worth considering a scheduled weekly npm audit fix PR bot or pinning the gate job to fail only on new findings vs a checked-in allowlist.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcelfolaron]

Status: ready-pending-CI · Priority: P2 (build-chain security, no runtime exposure) · Next action: run the audit/lint gate on this head, then merge · Owner: @marcelfolaron / @broskees

Automated maintainer review (advisory only — not an approval; merge authority stays with @marcelfolaron / @broskees). Reviewed at head bf576af3 — created today, first review. Single commit, lockfile-only.

1. Intent: Clears two newly-published high advisories re-redding the npm audit --audit-level=high gate repo-wide — brace-expansion (GHSA-3jxr-9vmj-r5cp, exponential-expansion DoS) and shell-quote (GHSA-395f-4hp3-45gv, quadratic-complexity DoS in parse()). Both transitive build-chain dev deps; no runtime exposure. Lockfile-only in-range refresh via npm audit fix (~15 lines), no package.json change.

2. Change requests — none blocking. Confirm-before-merge only:

1. ✓ Correct, minimal, and low-risk. Lockfile-only, in-range, package.json untouched — this is the right shape for a transitive-advisory bump. No behavior change, so no test is required (the test-gate doesn't apply to a dep-only lockfile refresh).
2. ◐ CR Documentation #1 — confirm the build still compiles on this head. The PR body states npx mix compiles cleanly and the gate exits 0; confirm CI reproduces that on bf576af3 (a transitive bump can occasionally shift a sub-dep that mix relies on).
3. ◐ CR Gitignore #2 (process, not blocking) — the recurring-advisory pattern. As the PR notes, this is the second such gate-only PR in three days; new upstream advisories re-red the gate with no code change on our side. Worth acting on your own suggestion: either a scheduled weekly npm audit fix PR bot, or pin the gate to fail only on new findings vs a checked-in allowlist, so this stops consuming review cycles. I can draft either as a follow-up if you want.

3. Acceptance checklist (must pass before merge):

1. CI green on bf576af3: npm audit --audit-level=high exits 0 and npx mix compiles (CR Documentation #1) — plus Pint/PHPStan if they gate this repo.
2. No package.json / runtime change — dev-dependency lockfile refresh only; no migration, no API/behavior change, no test required.
3. (Optional, tracked) decide on the recurring-audit automation so this doesn't recur weekly (CR Gitignore #2).

4. CI status — ⚠: Combined status on bf576af3 shows only license/cla (success) — the npm audit/mix gate has not reported on this head yet. Since the entire point of the PR is turning that gate green, confirm it actually runs and exits 0 on bf576af3 before merge. Low-risk change, but the gate is the whole deliverable.

Advisory only — not an approval, not marking ready, not merging. Merge authority stays with @marcelfolaron / @broskees.