From 20a456360bd0fcbe262701cec31db833644fc68e Mon Sep 17 00:00:00 2001
From: Raghu Betina <raghu@firstdraft.com>
Date: Tue, 4 Aug 2026 12:40:55 -0500
Subject: [PATCH] Patch brace-expansion advisory

Refresh the transitive ESLint lockfile entry to the release that closes GHSA-rgw5-rvv9-x895 so the audit-gated CLI workflows remain usable.
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c6faf64..3bacafd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -639,9 +639,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {