fix: pin brace-expansion to 5.0.12 so the publish audit passes

[ChiragAgg5k]

The 1.2.0 publish failed at npm audit --audit-level=high: brace-expansion 5.0.9 has new high advisories (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p). main already pins 5.0.12; this brings 1.x in line.

npm ci --omit=peer && npm audit --audit-level=high --omit=dev --omit=peer && npm run build
found 0 vulnerabilities

The lockfile change is the one brace-expansion entry. 1.2.0 never reached npm, so the release is re-cut from this commit.

[hansi-codes]

🟢 Tier S · Ready to merge

The reviewed change updates the overridden package to the requested version and has no apparent functional regression.

The package overrides now pin brace-expansion to 5.0.12, and the lockfile resolves that package version. This brings the 1.x dependency tree in line with the stated audit fix.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 2

File	Change
package.json	Updated the global and glob-specific brace-expansion overrides to 5.0.12.
package-lock.json	Updated the resolved brace-expansion package entry to 5.0.12.

---

_{Reviewed ae17b60 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary