SUPPLY-001D10 — Patch every affected brace-expansion lock resolution

[daliu]

Outcome

Update every affected root brace-expansion 1.x and 5.x lock resolution to its maintained patched release. Remove the brace-expansion denial-of-service advisory from both full and production-classified root audits without changing product code, direct dependencies, or package policy.

Atomic P0 child of #105 and the SUPPLY-001 delivery sequence. Follows #455.

Invariants

• package.json remains byte-identical: no direct dependency, override, resolution, script, or engine change.
• Existing parent ranges must admit every lock update; do not force a semver-incompatible major beneath an old caller.
• All package identities come from the public npm registry and are pinned by the committed lockfile.
• A green audit is not sufficient evidence: the installed public API must demonstrate the maintained behavior under a bounded synthetic regression.
• No application, Rules, Functions domain behavior, Firebase configuration, provider setting, production data, or deployment changes.

Why now

Exact main at 491cc22d80de1faae1960bd63c80ce62e648397b has 58 full-root audit findings (0 critical, 24 high, 21 moderate, 13 low) and 3 production-classified findings (0 critical, 2 high, 0 moderate, 1 low).

The lock contains twelve affected brace-expansion 1.x copies at 1.1.11, 1.1.12, or 1.1.14 and one affected 5.x copy at 5.0.5. Existing 2.x copies are already at patched 2.1.2. The current parent ranges admit 1.1.16 and 5.0.7. An isolated Node 20/npm 10 simulation updates exactly those thirteen package records and changes the audit snapshots to 57 full findings (0 critical, 23 high, 21 moderate, 13 low) and 2 production findings (0 critical, 1 high, 0 moderate, 1 low).

The remaining high production finding is minimatch. Although current advisory metadata treats legacy 3.x/5.x releases as patched, isolated Node 20 checks show those legacy releases still retain the problematic nested-extglob behavior. This issue must not describe that separate finding as remediated; a genuine parent-chain migration remains a later atomic slice.

Scope

• Regenerate only the root lockfile records needed to move all affected brace-expansion 1.x copies to 1.1.16 and the affected 5.x copy to 5.0.7, using Node 20/npm 10 with lifecycle scripts disabled.
• Add a dependency-free RED test for the exact affected-family floors, public-registry identities, installed copies, unchanged parent ranges, and absence of a direct manifest/override declaration.
• Add bounded child-process functional checks for the installed 1.x and 5.x public APIs plus ordinary expansion controls.
• Update the supply-chain ledger, backlog/status evidence, and officer publishing guide.
• Run clean-install, dependency-tree, full/production audit, frontend, Functions, Rules, commerce emulator, SPA, static-safety, lint, YAML, and diagnostic-build checks.
• Compare clean baseline and patched build output; investigate every changed deployable artifact.

Acceptance criteria

• Every locked brace-expansion 1.x copy is exactly 1.1.16, every 2.x copy remains exactly 2.1.2, and the sole 5.x copy is exactly 5.0.7.
• The lockfile contains no affected brace-expansion release and every changed identity is the reviewed public-registry tarball/integrity pair.
• package.json is byte-identical and no direct dependency, override, resolution, or new package is added.
• The bounded functional regression fails on the exact base lock install and passes on the patched install for both changed major families; ordinary supported expansion remains compatible.
• Full root audit changes from 58 to 57 findings by removing one high group; production-classified audit changes from 2 high/1 low to 1 high/1 low. No critical or new high finding appears.
• The remaining minimatch high finding is explicitly documented as unresolved and is not represented as functionally fixed by advisory metadata alone.
• Full local verification and clean Node 20 install pass; the Functions manifest, lockfile, and audit snapshots remain unchanged.
• Clean baseline/patched build comparison proves whether any deployable artifact changes; any change is explained and reviewed.
• Documentation distinguishes source changed, tests passed, merged, deployed, and production-verified states.

Out of scope

• Forcing or claiming a legacy minimatch patch; migrating old minimatch callers to a modern major; Babel-core, shell-quote, SDK, CRA, ESLint, or other dependency migrations; automated audit policy/SBOM; IAM/OIDC; branch protection; staging; deployment; provider configuration; or production testing.
• npm audit fix --force, semver-incompatible overrides, real Firebase projects, real member/payment data, or provider credentials.

Dependencies and failure cases

• Depends on the merged CI baseline, SUPPLY-001D8 — Patch the high-severity Babel SystemJS compiler chain #453, and SUPPLY-001D9 — Upgrade Firebase CLI to v15 and migrate emulator gates to Java 21 #455; all are complete.
• CI-001C — Configure protected short-lived Firebase deployment identity #133 and CI-001D — Prove backend-first staging and deploy the profile repair #136 remain external deployment blockers but do not block this source/tooling slice.
• Stop and split if the lock update changes package.json, requires a parent major, changes application behavior, or cannot pass the bounded regression and current full test/build gates.

Officer impact: None — this changes dependency records and developer/hosted checks only; no officer task or live surface changes.

Officer documentation: docs/officers/PUBLISH_AND_CHECK.md — records the internal dependency evidence and confirms officers do not install packages or run audit commands.

Deployment evidence: Source and synthetic local/hosted checks only. No website publication, Firebase deployment, provider configuration, production data access, or live behavior is authorized by this issue.

[daliu]

CLAIMED by /root at 2026-07-23T00:14:09Z; branch codex/issue-459-brace-expansion; base 491cc22.