From b2ffee56fb39d5854319c93de721c3c245dd8731 Mon Sep 17 00:00:00 2001
From: Sonu Kapoor <sonukapoor@gmail.com>
Date: Sat, 25 Jul 2026 12:22:38 -0400
Subject: [PATCH] fix: baseline unfixable brace-expansion dev advisory
 (GHSA-mh99-v99m-4gvg)

A new brace-expansion DoS advisory (published 2026-07-24) matches two
transitive dev dependencies (jest and ts-jest chains), failing self-scan on
every PR. The only fix is brace-expansion >= 5.0.8 (5.x rewrite, no backport);
no within-range update reaches it and, verified via the CLI's own scan,
upgrading the parents (jest@30.4.2) does not resolve the transitive chain.
Accept both findings via the ratcheting baseline per our fix-order policy;
new findings above baseline still fail.

Closes #895
---
 .cve-lite/baseline.json | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .cve-lite/baseline.json

diff --git a/.cve-lite/baseline.json b/.cve-lite/baseline.json
new file mode 100644
index 00000000..d4b75f9a
--- /dev/null
+++ b/.cve-lite/baseline.json
@@ -0,0 +1,20 @@
+{
+  "version": 1,
+  "createdAt": "2026-07-25T16:21:26.623Z",
+  "findings": [
+    {
+      "name": "brace-expansion",
+      "version": "2.1.2",
+      "advisoryIds": [
+        "GHSA-mh99-v99m-4gvg"
+      ]
+    },
+    {
+      "name": "brace-expansion",
+      "version": "1.1.16",
+      "advisoryIds": [
+        "GHSA-mh99-v99m-4gvg"
+      ]
+    }
+  ]
+}