fix: preflight AST walkers and derive expansion queues from traversal

[Passpass92]

Deep brace/parenthesis inputs and caller-created ASTs can overflow recursive walkers. This change adds iterative structural preflight, prevents foreign parent queues from entering expansion, and preserves range arguments across shared/repeated AST traversal.

Current head: 1f11eb558be9ea0cda87861408bb766e2e714086.

Changes:

• Reject excessive nesting, child cycles and more than 65,536 AST visits before recursive processing. Parser container depth and AST child-edge depth are capped at 128; terminal child nodes are counted separately. Violations use SyntaxError / ERR_BRACES_COMPLEXITY.
• F1: expansion derives queues from the actual child traversal, without reading parent metadata or consuming external queues.
• Shared expansion P2: range normalization uses local type/value copies and retains original children, so every shared occurrence is expanded.
• R1 (22a70381bdc89126033155fc00e5ce58f10f7776): fixed-position range-limit checking with inclusive cardinality, absolute direction/step normalization, character ranges and fill-range step precedence. Manual-AST function/options steps and boxed options steps are handled. Invalid ranges/steps retain dependency fallback/errors. false/Infinity still disable the size cap. Unsafe numeric endpoints are rejected even without a cap, because floating-point increments can stop making progress.
• R2 (1f11eb558be9ea0cda87861408bb766e2e714086): compilation normalizes local copies, preserving range markers for shared subtrees, repeated compile and mixed compile/expand sequences. No result cache or parent traversal is introduced.

Validation, performed by the implementer:

• R1: 129 targeted tests; final negative control on f6e4d5d gives 54 passing / 75 failing. A second targeted RED caught nine manual/boxed-step cases on the provisional R1 before they were corrected.
• R1 standalone: 1,115 tests pass on macOS Node 22.23.2 and Linux Node 8.3.0 / 20.20.2 / 22.23.2.
• R2: 22 targeted tests, with 2 passing / 20 failing before the change; all pass after it, including with a reduced stack.
• Final full suite: 1,137 tests passing on all four environments. Linux images are pinned by digest, networking is disabled, and source mounts are read-only. Dependencies remain fill-range 7.1.1 and Mocha 6.2.3.
• R1 ordinary-expression corpus: 448,952 comparisons against f6e4d5d, with 444,640 identical, 3,136 previously permitted over-limit expansions now rejected, and 1,176 previously erroneous rejections now accepted. Every raw difference is preserved and adjudicated using bounded reference generation with the actual fill-range dependency; no unexplained differences. The raw generic comparator returns 1 for these intended policy changes, not a misleading blanket PASS.
• R2 corpus: all 448,952 comparisons against the final R1 are identical. Each corpus run also includes 3,000 unchanged poisoned-parent comparisons.
• Range oracle: 41,184 checks with a normal stack and 41,184 with a reduced stack, comparing the guard/output/error behavior with bounded real fill-range generation across endpoints, step placements, strictness and limits.
• Final reruns: 144 structural/F1 probes and 86 shared-expansion probes pass at each of two stack sizes.
• Offline npm pack dry-run, git diff checks and redacted full-patch Gitleaks checks pass. Package name/version (3.0.3), dependency declarations and Node >=8.3 remain unchanged.

Independent review previously closed F1 and the shared-expansion P2 on f6e4d5d. Independent review of the two new commits/current head is pending. Current reruns are not presented as a fresh independent review, maintainer approval, CI qualification or npm publication.

Scope: rangeLimit bounds each expansion range, not Cartesian-product cardinality or compiled stepped-regex generation. Structural bounds do not qualify arbitrary getters/proxies, array-valued text nodes, or generated-regex execution time. Work queues and normalization metadata can still change; only range arguments/children are preserved by the relevant branches. Standalone brace nodes without an expansion container remain unsupported. No downstream deployment or alert closure is implied.

[jonschlinkert]

github/advisory-database#10132 (comment)

[BenkiNew]

Independent verification of head 1f11eb558be9ea0cda87861408bb766e2e714086 on Node 22.23.2:

• Existing suite: 1,137 passing.
• 2,061 compile/expand/stringify comparisons against master agree for ordinary nested patterns and ranges.
• 22 depth/cycle guard checks pass at both 512 KB and 984 KB V8 stack sizes, in child processes bounded to 128 MB / 5 seconds. Both unpatched negative controls fail as expected.
• 3,768 numeric/character range-limit cases agree with fill-range cardinality (including negative endpoints, descending ranges and negative steps). Three additional AST reuse checks preserve repeated compile/expand results and the original AST fields. These cover the R1/R2 changes.

Reproducible independent scripts: https://gist.github.com/BenkiNew/40827449253eb003106875520c792597 . Place clones at ./braces (this exact PR head) and ./braces-baseline (master e53730e); install fill-range 7.1.1 and run the scripts from their parent directory, with NODE_PATH pointing at those dependencies if necessary. The upstream suite additionally used Mocha 6.2.3 and bash-path 2.0.1.

This is evidence for the pinned implementation, not blanket validation of arbitrary Cartesian expansion or regex execution. I did not independently test Node 8 compatibility. No blocking defect was found in these checks. Thank you for keeping the preflight iterative and the range transformations non-mutating.