[dependabot-agent] npm audit fix: resolve high-severity brace-expansion/minimatch advisories in actions/setup/js

[cao-githubnext-gh-aw-cao-write]

Caution

Protected files were modified in this change.
This pull request is in request-review mode and requires explicit human scrutiny before merge.

Protected files: package-lock.json

Dependency Release Train Summary

What changed

• Package/ecosystem: npm (actions/setup/js)
• Manifest(s): actions/setup/js/package-lock.json (lockfile-only, no package.json change)
• Old versions: brace-expansion@1.1.16 / 2.1.2 / 5.0.8, minimatch@3.1.2
• New versions: brace-expansion@1.1.18 / 2.1.4 / 5.0.9, minimatch@3.1.5
• Update type: security (patch-level transitive bumps via npm audit fix --package-lock-only)

Why now

• npm audit --package-lock-only reported 2 high-severity advisories in this manifest,
  confirmed still present on main:
  • brace-expansion DoS via unbounded expansion length (GHSA-mh99-v99m-4gvg) and a
    bypass of that mitigation via unbounded intermediate arrays (GHSA-rgw5-rvv9-x895).
  • minimatch ReDoS via repeated wildcards (GHSA-3ppc-4f35-3m26), combinatorial
    backtracking via non-adjacent GLOBSTAR segments (GHSA-7r86-cg39-jmmj), and nested
    *() extglob backtracking (GHSA-23c5-xmqv-rm74).
• This candidate was flagged as an untried, independent lead in prior release-train
  cache-memory notes after several other candidates on github/gh-aw showed a
  suspicious non-landing pattern with create_pull_request — this PR also serves as a
  fresh data point on whether that pipeline issue has been resolved.

Risk assessment

• Runtime/dev/build/CI scope: dev-only — all four vulnerable packages are
  transitive devDependencies (via @actions/github-script, archiver-utils,
  readdir-glob), not shipped in any released artifact.
• Direct/transitive: transitive only; no package.json range changes.
• Reachability: lockfile-only; no source files in actions/setup/js import
  brace-expansion or minimatch directly. Not on auth/crypto/payment/db/
  serialization/telemetry/CI-runner/container-base surfaces.

Validation

• Commands run: npm audit --package-lock-only (before: 2 high, after: 0
  vulnerabilities), npm ci --prefer-offline, npx tsc --noEmit (clean).
• Result: audit clean; typecheck passes with no errors.
• Remaining gaps: vitest run in this sandbox has ~450 pre-existing failures
  unrelated to this change (mock LLM-proxy 429s, a step-summary ENOENT writer
  issue, and firewall-network-block assertion drift in
  update_pr_description_helpers.test.cjs) — confirmed identical failure set with
  this commit stashed out, so they predate this bump. Recommend CI's clean
  environment for full test confirmation.

Sensitive surface area

• None — dev-tooling transitive dependency bump only.

Breaking-change notes

• None; patch-level bumps within already-declared semver ranges, resolved purely
  via npm audit fix --package-lock-only.

Reviewer checklist

• CI passes
• CODEOWNERS or service owners reviewed
• Security-sensitive areas approved, if applicable
• Deployment/canary owner confirms runtime health, if needed

Rollback guidance

• Revert this PR (single lockfile file) to restore prior transitive resolutions.

Control Plane

• Correlation ID: 34519837595-1019
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34519837595

Smart-Dependabot-Merge-Candidate: yes

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: The process '/usr/bin/git' failed with exit code 128

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

Create the pull request manually

# Download the artifact from the workflow run
gh run download '34519837595' -n agent -D '/tmp/agent-34519837595'

# Resolve the bundle source ref, fetch it into a temporary ref, then create the local branch
bundle_path='/tmp/agent-34519837595/aw-github-gh-aw-dependabot-agent-actions-setup-js-npm-audit-fix-20260910194242.bundle'
temp_ref='refs/bundles/create-pr-dependabot-agent-actions-setup-js-npm-audit-fix-20260910194242-3e3bf8ad'
target_ref='refs/heads/dependabot-agent/actions-setup-js-npm-audit-fix-20260910194242'
bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 ~ /^refs\/heads\// { print $2 }')
if [ -z "$bundle_source_ref" ]; then
  bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 == "HEAD" { print $2 }')
fi
if [ "$(printf '%s\n' "$bundle_source_ref" | sed '/^$/d' | wc -l | tr -d ' ')" != "1" ]; then
  echo "Expected exactly one bundle source ref, found: $bundle_source_ref" >&2
  exit 1
fi
git fetch "$bundle_path" "${bundle_source_ref}:${temp_ref}"
git update-ref "$target_ref" "$temp_ref"
git checkout 'dependabot-agent/actions-setup-js-npm-audit-fix-20260910194242'
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d "$temp_ref"

# Push the branch to the target remote
git push 'origin' 'dependabot-agent/actions-setup-js-npm-audit-fix-20260910194242'

# Create the pull request
gh pr create --title '[dependabot-agent] npm audit fix: resolve high-severity brace-expansion/minimatch advisories in actions/setup/js' --base 'main' --head 'dependabot-agent/actions-setup-js-npm-audit-fix-20260910194242' --repo 'github/gh-aw'

Generated by Dependabot / Release Trains · copilot · auto · 134.1 AIC · ⌖ 11.4 AIC · ⊞ 18.4K · ◷

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main