fix: prevent stack exhaustion from deeply nested brace patterns

[akahungryy]

Deeply nested patterns within the existing length limit exhaust the stack in recursive AST processing (GHSA-vfj7-8cjw-p6xm). The failure reproduces in compile, expand and stringify with 3,000 nested braces.

This change limits brace and parenthesis nesting to 100, with a maxDepth option that can lower the limit but cannot raise the safety cap. Compile, expand and stringify also enforce the limit for caller-provided ASTs, and expansion detects cyclic parent chains. Excessive string nesting throws SyntaxError; excessive AST depth and parent cycles throw RangeError.

The intentional compatibility change is rejection of patterns nested beyond 100 levels. This bounds the recursive walkers rather than replacing them with iterative implementations. Expansion-size risks remain outside this patch.

Validation on Node 24:

• Full upstream npm test: 908 passing, zero failures.
• Focused parse/compile/expand/stringify tests: 48 passing.
• Bounded children with --stack-size=512: all four public APIs reject 3,000-level inputs with the intended guard errors; AST-cycle and option-clamp checks pass.
• Independent read-only security review found no stack-overflow bypass in the affected paths.

The existing Node 8 assertion shim is extended for doesNotThrow; Node 8 runtime compatibility has not been exercised. No version bump is included; a maintainer release is still required.

[ulises-jeremias]

Independent validation on the current head d44b9b1: npm test passes on Node 24.17.0 (908 passing). With --stack-size=512, I also exercised parse, compile, expand, stringify, the default API, and an attempted maxDepth: 3000 bypass against 3,000 nested braces; each rejected safely. GitHub currently reports no checks for this branch. This is a promising fix for GHSA-vfj7-8cjw-p6xm; a published upstream release is still needed before downstream projects can replace source pins or clear their dependency audits.

[ahmed-anis-rowaished]

Independent security and regression evaluation

I independently evaluated this PR at commit d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe against the stack-exhaustion issue tracked as GHSA-vfj7-8cjw-p6xm / CVE-2026-93687.

Verification summary:

• Confirmed that published braces 3.0.3 and current unpatched master can terminate with RangeError: Maximum call stack size exceeded when processing deeply nested but size-bounded input.
• Executed the reproduction in an isolated child process with a five-second timeout and restricted stack size.
• Verified the candidate across braces(), compile(), expand(), stringify(), caller-provided deep ASTs, and cyclic parent references.
• The candidate rejected excessive depth deterministically with controlled errors instead of exhausting the call stack.
• Full upstream suite: 908 passed, 0 failed.
• Valid brace expansion regression cases remained equivalent to braces 3.0.3.
• git diff --check passed.
• No dependency, installation-script, workflow, binary, or unrelated supply-chain changes were observed in the reviewed diff.
• A normal-input benchmark of 10,000 iterations completed in approximately 118.59 ms, compared with approximately 103.89 ms on the unpatched baseline in the same environment.

The most important property of this approach is that it protects every recursive AST traversal, including externally supplied ASTs and cyclic parent references, rather than guarding only the parser.

Environment used for this independent check: Windows_NT 10.0.26200 (x64), Node.js v24.19.0, npm 11.17.0.

This is an independent engineering review, not a formal security audit. Based on the tested commit, the patch appears suitable for maintainer review and a patched npm release. Publishing an official release and updating the GitHub advisory’s patched-version metadata would unblock downstream consumers that cannot safely use forks, overrides, or unpublished commits.