[Aikido] Fix 13 security issues in brace-expansion, ansi-regex, minimatch

[aikido-autofix]

Upgrade brace-expansion, ansi-regex, and minimatch to fix memory exhaustion DoS and ReDoS vulnerabilities.

⚠️ Breaking changes analysis not available for: minimatch

✅ No breaking changes for: brace-expansion, ansi-regex

✅ 13 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-14257	HIGH	[brace-expansion] Denial of service via memory exhaustion when expand() processes chained brace groups, allowing attackers to crash applications with small inputs by generating progressively longer result strings that exceed memory limits.
AIKIDO-2026-872981	HIGH	[brace-expansion] A vulnerability in the expand() function allows unbounded intermediate array generation during brace expansion, enabling a small crafted input to exhaust process memory or cause denial of service through event loop blocking.
CVE-2026-69152	HIGH	[brace-expansion] A memory exhaustion and event loop blocking vulnerability exists in the expand() function when processing attacker-controlled input with comma-alternatives or padded sequences, bypassing previous DoS protections.
AIKIDO-2026-237551	MEDIUM	[brace-expansion] A recursive expansion function computes unnecessary segments before early returns, causing exponential time complexity when processing consecutive non-expanding brace groups, enabling denial-of-service attacks through short malicious inputs that can stall processes or workers.
CVE-2026-13149	MEDIUM	[brace-expansion] A denial of service vulnerability exists in the expand() function due to exponential-time complexity when processing consecutive non-expanding brace groups, allowing attackers to cause significant CPU consumption and event-loop blocking.
CVE-2026-33750	LOW	[brace-expansion] A brace pattern with zero step value causes an infinite loop, leading to denial of service through process hangs and excessive memory allocation. The vulnerability affects string expansion operations when malicious or malformed patterns are processed.
AIKIDO-2026-10477	LOW	[brace-expansion] A denial-of-service vulnerability allows attackers to craft malicious brace patterns with repeated numeric ranges that cause exponential expansion, consuming excessive CPU and memory until process failure. The fix introduces an optional maximum limit parameter to bound expansion work.
CVE-2025-5889	LOW	[brace-expansion] A regular expression complexity vulnerability in the expand function allows remote attackers to cause denial of service through inefficient regex processing, though exploitation is difficult and requires high attack complexity.
CVE-2021-3807	LOW	[ansi-regex] is vulnerable to Inefficient Regular Expression Complexity
CVE-2022-3517	LOW	[minimatch] A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
CVE-2026-26996	LOW	[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903	LOW	[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904	LOW	[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.

🤖 Remediation details

Fix transitive security vulnerabilities in brace-expansion, minimatch, and ansi-regex

Short summary

This PR remediates security vulnerabilities in three transitive dependencies — brace-expansion, minimatch, and ansi-regex — all resolved exclusively in docs/package-lock.json. None of the three packages appear as direct dependencies in docs/package.json, so no manifest edits were required; all fixes are lockfile-only, achieved by running npm update against the immediate parent packages to allow npm to resolve patched versions within already-declared semver ranges.

brace-expansion

brace-expansion is pulled in transitively by minimatch, which declares it as ^1.1.7. The lockfile had pinned brace-expansion at 1.1.11, which is vulnerable. Because minimatch's declared range already permits 1.1.18, running npm update minimatch --package-lock-only was sufficient to allow npm to resolve brace-expansion to 1.1.18 — the patched floor that addresses all applicable advisories — without any manifest change.

minimatch

minimatch is pulled in transitively by glob, which declares it as ^3.0.4. The lockfile had pinned minimatch at 3.0.4, which is vulnerable. Because glob's declared range already permits 3.1.4+, running npm update glob --package-lock-only was sufficient to allow npm to resolve minimatch to 3.1.5, satisfying the patched version requirement without any manifest change.

ansi-regex

ansi-regex is pulled in transitively by strip-ansi, which declares it as ^4.1.0. The lockfile had pinned ansi-regex at 4.1.0, which is vulnerable. Because strip-ansi's declared range already permits 4.1.1, running npm update strip-ansi --package-lock-only was sufficient to allow npm to resolve ansi-regex to 4.1.1 — the patched version — without any manifest change.

Version changes

Package	From	To	Why updated
brace-expansion	1.1.11	1.1.18	Vulnerable package; semver resolution via parent minimatch
minimatch	3.0.4	3.1.5	Vulnerable package; semver resolution via parent glob
glob	7.1.6	7.2.3	Parent bump to allow minimatch to resolve to patched version
ansi-regex	4.1.0	4.1.1	Vulnerable package; semver resolution via parent strip-ansi

[github-actions]

Package lock diff

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 15 security issues in brace-expansion, ansi-regex, minimatch