fix(docs): resolve CVE-2026-13149 in both brace-expansion copies

[alexhancock]

A prior approach to this added brace-expansion as a direct dependency, which only bumped the hoisted 1.x copy (1.1.12 -> 1.1.16). The nested node_modules/glob/node_modules/brace-expansion copy (pulled via tailwindcss -> sucrase -> glob) stayed at 2.0.2, which is within the advisory's vulnerable range (>=2.0.0, <2.1.2), so scanners would keep flagging CVE-2026-13149.

Use version-scoped npm overrides instead so every copy is patched:

• brace-expansion@1.x -> 1.1.16
• brace-expansion@2.x -> 2.1.2

This also avoids declaring a direct dependency the docs site never imports.

[github-actions]

Documentation preview deployed: https://pr-10842.goose-pr-previews-poc.pages.dev

[jbg]

The overrides are not needed and are just duplicating the functionality of the lockfile -- the fixed brace-expansion versions are compatible with the versions declared by our dependencies so they just need to be updated in the lockfile. Proof:

Vulnerability exists:

# npm ci --ignore-scripts && npm audit --json | jq '.vulnerabilities["brace-expansion"] // "not present"'
{
  "name": "brace-expansion",
  "severity": "high",
  "isDirect": false,
  "via": [
    {
      "source": 1115540,
      "name": "brace-expansion",
      "dependency": "brace-expansion",
      "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
      "severity": "moderate",
      "cwe": [
        "CWE-400"
      ],
      "cvss": {
        "score": 6.5,
        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
      },
      "range": "<1.1.13"
    },
    {
      "source": 1115541,
      "name": "brace-expansion",
      "dependency": "brace-expansion",
      "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
      "severity": "moderate",
      "cwe": [
        "CWE-400"
      ],
      "cvss": {
        "score": 6.5,
        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
      },
      "range": ">=2.0.0 <2.0.3"
    },
    {
      "source": 1123896,
      "name": "brace-expansion",
      "dependency": "brace-expansion",
      "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
      "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
      "severity": "high",
      "cwe": [
        "CWE-400",
        "CWE-407"
      ],
      "cvss": {
        "score": 5.3,
        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
      },
      "range": ">=2.0.0 <2.1.2"
    },
    {
      "source": 1123897,
      "name": "brace-expansion",
      "dependency": "brace-expansion",
      "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
      "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
      "severity": "high",
      "cwe": [
        "CWE-400",
        "CWE-407"
      ],
      "cvss": {
        "score": 5.3,
        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
      },
      "range": "<1.1.16"
    },
    {
      "source": 1124334,
      "name": "brace-expansion",
      "dependency": "brace-expansion",
      "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
      "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
      "severity": "high",
      "cwe": [
        "CWE-400",
        "CWE-770"
      ],
      "cvss": {
        "score": 7.5,
        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "range": "<=5.0.7"
    }
  ],
  "effects": [],
  "range": "<=5.0.7",
  "nodes": [
    "node_modules/brace-expansion",
    "node_modules/glob/node_modules/brace-expansion"
  ],
  "fixAvailable": true
}

Update lockfile:

# npm update brace-expansion --package-lock-only --ignore-scripts

Vulnerability no longer exists:

# npm audit --json | jq '.vulnerabilities["brace-expansion"] // "not present"'
{
  "name": "brace-expansion",
  "severity": "high",
  "isDirect": false,
  "via": [
    {
      "source": 1124334,
      "name": "brace-expansion",
      "dependency": "brace-expansion",
      "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
      "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
      "severity": "high",
      "cwe": [
        "CWE-400",
        "CWE-770"
      ],
      "cvss": {
        "score": 7.5,
        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "range": "<=5.0.7"
    }
  ],
  "effects": [
    "minimatch"
  ],
  "range": "<=5.0.7",
  "nodes": [
    "node_modules/brace-expansion",
    "node_modules/glob/node_modules/brace-expansion"
  ],
  "fixAvailable": true
}

(note that one GHSA remains, but the override doesn't fix that either since it's vulnerable up to and including v5.0.7)

The fix for the CVE is simply to run npm update brace-expansion --package-lock-only --ignore-scripts and commit the lockfile change, no overrides are needed.

[jbg]

overrides are the wrong hammer here (see my bigger comment above)

it would also be fine to just update the whole lockfile imo

[alexhancock]

@jbg I had done overrides because I thought if we install a new package that depends on these, they could come back, but if they use normal caret ranges I guess the risk of that happening is pretty low. The new dep would need to pin a dep on the problematic versions of the transitive package.

I will repush just updating the lockfile.