Bump brace-expansion from 1.1.11 to 1.1.12 in /controlpanel

[dependabot]

Bumps brace-expansion from 1.1.11 to 1.1.12.

Release notes

Sourced from brace-expansion's releases.

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• c85b8ad 4.0.1
• 5a5cc17 fmt
• 0b6a978 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• 6a39bdd 4.0.0
• dd72a59 fmt
• 278132b feat: use string replaces instead of splits (#64)
• 70e4c1b add tea.yaml
• b01a637 3.0.0
• 9e781e9 node 16 is EOL
• 6dad209 docs
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[alexcos20]

@dependabot rebase

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, opened by Dependabot, updates the brace-expansion dependency in the controlpanel/package-lock.json file. The version is bumped from 1.1.11 to 1.1.12 for several nested instances and from 2.0.1 to 2.0.2 for the top-level entry. This is a routine dependency update, likely addressing minor bug fixes or security improvements in the brace-expansion library. The license field has also been added for clarity in the package-lock.json entries.

Comments:
• [INFO][other] This updates brace-expansion from 1.1.11 to 1.1.12 for an indirect dependency. This is a minor version bump, which typically indicates bug fixes and should be safe to merge.
• [INFO][style] Adding the "license": "MIT" field explicitly in the package-lock.json is a good practice for dependency metadata.
• [INFO][other] This updates the root brace-expansion dependency from 2.0.1 to 2.0.2. As with other minor bumps, this is expected to be non-breaking and improve stability or security.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the brace-expansion dependency from version 1.1.11 to 1.1.12 and from 2.0.1 to 2.0.2 within the /controlpanel directory's package-lock.json. These updates address a Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2023-49080). This is an automated dependency update by Dependabot to improve security.

Comments:
• [INFO][security] This Dependabot PR correctly updates brace-expansion to address the ReDoS vulnerability (CVE-2023-49080). It's good practice to keep dependencies updated, especially for security fixes. The patch looks straightforward, only modifying package-lock.json as expected for a dependency update.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the brace-expansion dependency from version 1.1.11 to 1.1.12 (and 2.0.1 to 2.0.2 for one instance) in the controlpanel/package-lock.json file. This is a routine dependency patch update initiated by Dependabot. The changes primarily involve updating versions and integrity hashes for brace-expansion across various nested dependencies and adding license fields. Additionally, several optional platform-specific @parcel/watcher-* packages have been added to the lockfile, and utf-8-validate has been removed, likely due to transitive dependency resolution changes.

Comments:
• [INFO][other] This PR updates brace-expansion to a patch version. Patch versions typically contain bug fixes and minor improvements, making this a low-risk update. The added @parcel/watcher-* optional dependencies are standard lockfile churn for multi-platform projects, and the removal of utf-8-validate suggests it's no longer a required transitive dependency for the current dependency graph, which is generally acceptable for optional dependencies.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the brace-expansion dependency from version 1.1.11 to 1.1.12 (and 2.0.1 to 2.0.2 for another instance) within the controlpanel directory. This is a minor patch version update for a widely used utility library. The primary change is in controlpanel/package-lock.json, which also includes an expansion of @parcel/watcher platform-specific optional dependencies and the removal of utf-8-validate from the lock file, likely due to a full regeneration of the lockfile or dependency resolution changes.

Comments:
• [INFO][other] While the primary intent of this PR is to bump brace-expansion, the package-lock.json shows significant changes, including the addition of many @parcel/watcher-* optional platform modules and the removal of utf-8-validate. This suggests the lockfile was fully regenerated. Please ensure that running npm install locally with this new package-lock.json still results in a stable and functional environment for the controlpanel.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the brace-expansion dependency to its latest patch versions (1.1.12 and 2.0.2) within the /controlpanel directory. This is a routine dependency upgrade to potentially incorporate minor bug fixes or improvements. The package-lock.json file reflects these changes, along with the addition of several @parcel/watcher platform-specific optional dependencies and the removal of utf-8-validate.

Comments:
• [WARNING][other] The dependency utf-8-validate has been removed from the package-lock.json. While this change might be an expected outcome of the updated dependency resolution, utf-8-validate is often used by libraries like ws for performance-critical UTF-8 validation. Please confirm that its removal does not introduce any regressions in functionality or performance for components that might have relied on it, especially if any indirect dependency previously required it.
• [INFO][other] Several new optional @parcel/watcher-* dependencies have been added to the lock file for various platforms (e.g., android-arm64, darwin-x64, linux-x64-glibc, win32-x64). This is likely a normal consequence of npm install regenerating the lock file, pulling in optional native modules for different environments. This typically doesn't impact the installed dependencies on a single target platform, but it's good to be aware of the increased size and complexity of the lockfile.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the brace-expansion dependency in the /controlpanel directory from version 1.1.11 to 1.1.12 (and 2.0.1 to 2.0.2 for another instance), as well as indirect occurrences of the package. These are minor version bumps. The changes are confined to controlpanel/package-lock.json. Additional changes include the explicit addition of the MIT license for brace-expansion entries and the inclusion of several optional @parcel/watcher-* platform-specific dependencies, likely due to lock file regeneration. Notably, node_modules/utf-8-validate has been removed from the lock file.

Comments:
• [INFO][other] The node_modules/utf-8-validate package has been removed. While this is likely an incidental change during package-lock.json regeneration and not directly related to brace-expansion, please ensure that its removal does not impact any functionality within the controlpanel that might have implicitly relied on it. Given it's often an optional dependency for websocket libraries, its absence should be verified by running tests.
• [INFO][other] Multiple new @parcel/watcher-* optional dependencies (e.g., -android-arm64, -darwin-x64, -linux-*, -win32-*) have been added. This is a common side effect of npm/yarn regenerating the lock file and making optional native modules explicit for various platforms. It generally doesn't introduce issues as these are only installed if relevant to the current environment.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the brace-expansion dependency to version 1.1.12 (and 2.0.2 for its direct entry) within the /controlpanel directory. This is a patch release that addresses a known ReDoS (Regular Expression Denial of Service) vulnerability (CVE-2022-37601) in brace-expansion. The changes are limited to package-lock.json and include typical updates to transitive dependencies, such as the addition of various @parcel/watcher-* optional platform-specific packages and the removal of the utf-8-validate optional/peer dependency.

Comments:
• [INFO][security] The update of brace-expansion from 1.1.11 to 1.1.12 (and 2.0.1 to 2.0.2 in its direct entry) addresses a ReDoS vulnerability (CVE-2022-37601). This is a beneficial security fix. Dependabot correctly identified and updated this dependency.
• [INFO][other] Multiple @parcel/watcher-* packages (e.g., watcher-android-arm64, watcher-darwin-x64, watcher-linux-*, watcher-win32-*) have been added as optional dependencies. These are platform-specific native modules for file watching, likely resolved by npm or yarn when regenerating the lock file across different potential build environments. As they are marked optional, they should only be installed if required for the specific platform, and their presence in the lock file is generally harmless.
• [INFO][other] The node_modules/utf-8-validate entry has been removed. This package was previously listed as optional: true and peer: true. This likely indicates that no current, installed dependency explicitly requires it anymore, or an upstream dependency that used it has updated to a version that no longer needs it. Given its optional/peer status, this removal is generally safe and a result of the dependency tree resolution.