fix(security): patch audited brace-expansion dependency

.github/workflows/security-audit.yml

@@ -8,6 +8,8 @@ on:
       - "cli/deno.json"
       - "react/deno.json"
       - "extensions/**/deno.json"
+      - "storybook/package.json"
+      - "storybook/package-lock.json"
       - "scripts/build/generate-sbom.ts"
       - "scripts/lib/deno-lock.ts"
       - "scripts/lint/audit-core-deps.ts"

deno.json

@@ -545,7 +545,7 @@
     "sbom": "deno run --allow-read --allow-write scripts/build/generate-sbom.ts",
     "sbom:all": "deno run --allow-read --allow-write scripts/build/generate-sbom.ts --all-manifests",
     "submit-deps": "deno run --allow-read --allow-env --allow-net=api.github.com scripts/security/submit-dependency-snapshot.ts",
-    "audit": "deno run --allow-read --allow-run --allow-write scripts/security/audit-npm.ts"
+    "audit": "deno run --allow-read --allow-run --allow-write scripts/security/audit-npm.ts && npm --prefix storybook audit --package-lock-only --audit-level=high"
   },
   "lint": {
     "include": [

extensions/ext-sandbox-shell-tools/deno.json

@@ -14,7 +14,7 @@
   "imports": {
     "ai": "npm:ai@7.0.41",
     "bash-tool": "npm:bash-tool@1.3.18",
-    "brace-expansion": "npm:brace-expansion@5.0.8",
+    "brace-expansion": "npm:brace-expansion@5.0.9",
     "just-bash": "npm:just-bash@3.0.1",
     "@std/assert": "jsr:@std/assert@1.0.19",
     "@std/testing/bdd": "jsr:@std/testing@1.0.17/bdd",

scripts/build/npm-package-metadata.test.ts

@@ -404,7 +404,7 @@ describe("normalizeNpmPackageMetadata", () => {
         "@opentelemetry/sdk-metrics": "2.8.0",
         "@opentelemetry/sdk-node": "0.218.0",
         "@sentry/deno": "10.68.0",
-        "brace-expansion": "5.0.8",
+        "brace-expansion": "5.0.9",
         "gaxios": "7.2.0",
         "gcp-metadata": "8.1.2",
         "protobufjs": "7.6.5",

scripts/security/audit-npm.test.ts

@@ -1,5 +1,6 @@
-import { assertEquals } from "#std/assert";
-import { describe, it } from "#std/testing/bdd";
+import { parse } from "#std/yaml/parse";
+import { assertEquals } from "#veryfront/testing/assert.ts";
+import { describe, it } from "#veryfront/testing/bdd.ts";
 import { buildAuditPackageJson, collectNpmDependencies } from "./audit-npm.ts";
 
 describe("collectNpmDependencies", () => {
@@ -68,3 +69,27 @@ describe("buildAuditPackageJson", () => {
     assertEquals(pkg.peerDependenciesMeta, undefined);
   });
 });
+
+describe("audit task", () => {
+  it("audits the independent Storybook package lock", async () => {
+    const denoConfig = JSON.parse(await Deno.readTextFile("deno.json"));
+    const workflow = await Deno.readTextFile(
+      ".github/workflows/security-audit.yml",
+    );
+    const pullRequestPaths = (parse(workflow) as {
+      on: { pull_request: { paths: string[] } };
+    }).on.pull_request.paths;
+
+    assertEquals(
+      denoConfig.tasks.audit.includes(
+        "npm --prefix storybook audit --package-lock-only --audit-level=high",
+      ),
+      true,
+    );
+    assertEquals(pullRequestPaths.includes("storybook/package.json"), true);
+    assertEquals(
+      pullRequestPaths.includes("storybook/package-lock.json"),
+      true,
+    );
+  });
+});

scripts/test.deno.json

@@ -13,6 +13,7 @@
     "#std/fs/ensure-dir": "jsr:@std/fs@1.0.23/ensure-dir",
     "#std/path": "jsr:@std/path@1.1.4",
     "#std/path.ts": "jsr:@std/path@1.1.4",
+    "#std/yaml/parse": "jsr:@std/yaml@1.1.0/parse",
     "#std/testing/bdd": "jsr:@std/testing@1.0.17/bdd",
     "#std/testing/bdd.ts": "jsr:@std/testing@1.0.17/bdd"
   }