fix(security): patch Cuabot brace expansion

[0xjohnnydev]

Problem

Cuabot currently forces brace-expansion 2.0.3. GitHub Dependabot reports two security advisories for this dependency graph, including a high alert whose patched release is in the 5.0.8 line.

What changed

• Raise the Cuabot brace-expansion override to 5.0.8.
• Regenerate the Cuabot lockfile so the override and resolved minimatch dependency use the patched package.
• This focused draft covers the current visible alerts fix(computer-server): MCP handler consistency and uiautomator fix #881 and feat: add optional VNC password authentication #1072, which share the Cuabot lock graph and require the same patched 5.0.8 resolution; it also preserves the earlier Fix playground model selection and UI improvements #1030 mapping for review history.

Definition of Done

• Current visible Cuabot brace-expansion alerts fix(computer-server): MCP handler consistency and uiautomator fix #881 and feat: add optional VNC password authentication #1072 are mapped to this focused draft; historical Fix playground model selection and UI improvements #1030 coverage is retained for review context.
• The lockfile resolves brace-expansion 5.0.8 and balanced-match 4.0.4, outside the reported vulnerable ranges.
• The Cuabot TypeScript build passes.
• A maintainer reviews the Node 20 engine requirement introduced by brace-expansion 5.0.8 and advances this draft; this automation will not merge or mark it ready.
• GitHub closes the alerts after the reviewed fix reaches the default branch.

Validation

• pnpm install --frozen-lockfile --ignore-scripts in libs/cuabot.
• pnpm run build in libs/cuabot.
• git diff --check.

Impact

This changes only the Cuabot dependency graph. The patched package requires Node 20 or newer; the repository's Cuabot release workflows use supported modern Node versions, but human review should confirm all published installation paths before merge.

[github-actions]

📦 Publishable packages changed

This comment is status-only. Editing it or adding task-list checkboxes cannot authorize a release.
Only owner-applied release:<service> labels can do that.

• ⏸️ npm/cuabot — no owner-authorized release label

Ask the release owner to apply release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[0xjohnnydev]

Closing this draft because its brace-expansion fix is now included in draft #2718 on the same Cuabot package and lockfile. #2718 contains both patched dependencies and the combined validation. Nothing was merged or marked ready.