fix(deps): floor all three brace-expansion majors on their complete fixes

[sweetrb]

Ports apple-mail-mcp#123 here — and closes the gap that PR could not see. mail resolves only two brace-expansion majors; this repo resolves three, and two of its four resolved paths sat below even the advisory's own floor.

line	before	after
v1 (eslint → minimatch@3)	1.1.16 — unpatched	1.1.18
v2 (minimatch@9)	2.1.3	2.1.4
v5 (minimatch@10.2.5/10.2.6)	5.0.7 — unpatched / 5.0.8	5.0.9

Why the advisory's own floor isn't enough

GHSA-mh99-v99m-4gvg / CVE-2026-14257 (high). The first-patched versions (1.1.17 / 2.1.3 / 5.0.8) bound the accumulator in combine but never thread maxLength into expandSequence, so the sequence path ({1..N}, {a..z..k}) stays capped only by item count:

-function expandSequence(body, isAlphaSequence, max)
+function expandSequence(body, isAlphaSequence, max, maxLength)
+    if (length + c.length > maxLength) break

A padded sequence therefore still materialises ~100,000 intermediate strings before the outer bound truncates — 4,606 ms / 176 MB RSS on 1.1.17 vs 9 ms / 61 MB on 1.1.18, for byte-identical final output. 1.1.18 / 2.1.4 / 5.0.9 add the missing bound; verified by diffing the published tarballs, not by reading the advisory text.

Why three separate two-sided floors

The majors are not API-compatible: minimatch@3 requires the v1 CommonJS API, so one floor spanning all three fails with expand is not a function. And the bounds must be two-sided — a bare <5.0.9 also matches 1.1.18 and 2.1.4 under semver, which would drag the CommonJS path onto the v5 ESM API.

Verified against the lockfile's own overrides: section, the only positive evidence an override is live (pnpm has never read npm's bare top-level overrides field, and warns about nothing when one is inert).

Verification

• pnpm install → "Lockfile passes supply-chain policies"; no minimumReleaseAgeExclude, no audit suppression. All three releases cleared the 24 h minimumReleaseAge gate (published 2026-07-30 ~10:00–10:17Z).
• pnpm run typecheck, pnpm run lint (0 errors), pnpm run format:check, pnpm test — all pass.
• pnpm run build → committed bundle byte-identical (SHA-256 unchanged), so no version bump is owed.

Dev toolchain only — brace-expansion is not in the shipped bundle and this repo's runtime dependencies are unaffected, so nothing that ships to npm changes.

Thanks to @jjoanna2-debug for the original finding in apple-mail-mcp#119/#121.