# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Resolve Dependabot alert https://github.com/giselles-ai/giselle/security/dependabot/142
  (GHSA-f886-m6hf-6m8v / CVE-2026-33750: brace-expansion zero-step ReDoS hang)

## Goal (incl. success criteria)

- Bump transitive `brace-expansion` past the vulnerable range (>= 4.0.0, < 5.0.5)
  so the alert closes once merged.

## Constraints/Assumptions

- Only the >= 4.0.0 range is present in our lockfile (was 5.0.2). The < 1.x, 2.x,
  3.x ranges aren't in the dep tree.
- `brace-expansion` is a transitive dep (via `minimatch` 9.x and 10.x), so the
  fix has to live as a pnpm override.

## Key decisions

- Used a scoped pnpm override `"brace-expansion@>=4.0.0 <5.0.5": "5.0.5"` rather
  than a blanket pin, matching the style of existing scoped overrides
  (e.g. `glob@>=11.0.0 <11.1.0`, `path-to-regexp@>=8.0.0 <8.4.0`).
- Considered fixing it via a library update instead of an override:
  - `minimatch@9.0.8` and `minimatch@10.2.4` already declare `^5.0.2`, which
    semver-allows `5.0.5` — bumping minimatch is unnecessary; the lockfile was
    just pinned to the older patch.
  - `pnpm update -r brace-expansion` does pull 5.0.5, but it cascades through
    the catalog and bumps `zod` 4.1.12 → 4.3.6. That's out of scope for a
    security patch, so we kept the override approach.
  - `pnpm update brace-expansion` (non-recursive) is a no-op (root has no
    direct dep on it).

## State

- Override added in `package.json`; `pnpm install --lockfile-only` rewrote
  `pnpm-lock.yaml` so both `minimatch@9.0.8` and `minimatch@10.2.4` now pull
  `brace-expansion@5.0.5`.

## Done

- `package.json`: added `"brace-expansion@>=4.0.0 <5.0.5": "5.0.5"` to
  `pnpm.overrides`.
- `pnpm-lock.yaml`: refreshed; `brace-expansion@5.0.5` is the only version.

## Now

- Running quality gates (`pnpm format`, `build-sdk`, `check-types`, `test`).

## Next

- Open PR titled around the CVE; reference the alert URL in full per repo
  feedback rule.

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- package.json
- pnpm-lock.yaml
- Alert: https://github.com/giselles-ai/giselle/security/dependabot/142
- Advisory: https://github.com/advisories/GHSA-f886-m6hf-6m8v
