chore: upgrade brace-expansion to address CVE-2026-13149

[linear-code]

Fixes SOU-1549

Refreshes brace-expansion in yarn.lock to patched versions to address CVE-2026-13149 (DoS via exponential-time complexity in expand()).

The existing ^1.1.13, ^2.0.3, and ^5.0.5 ranges (all requested transitively via minimatch) already admitted the patched releases, so only a lockfile refresh (yarn up -R brace-expansion) was needed:

• 1.1.14 → 1.1.16
• 2.1.0 → 2.1.2
• 5.0.6 → 5.0.7

yarn why brace-expansion confirms all three instances are now on patched versions.

---

Note

Low Risk
Dependency-only security patch with no runtime logic changes; low risk aside from routine transitive dependency churn.

Overview
Refreshes yarn.lock so all transitive brace-expansion copies resolve to patched releases, addressing CVE-2026-13149 (DoS from exponential-time behavior in expand()). No application code changes.

Resolved versions move from 1.1.14 → 1.1.16, 2.1.0 → 2.1.2, and 5.0.6 → 5.0.7. Existing Yarn resolutions in package.json already admitted these versions; the change is a lockfile refresh only.

Documents the fix under Unreleased → Fixed in CHANGELOG.md.

^{Reviewed by Cursor Bugbot for commit a3b53ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.