fix: bump brace-expansion to 5.0.6 (GHSA-jxxr-4gwj-5jf2)

[Copilot]

brace-expansion@5.0.5 has a moderate-severity DoS vulnerability (GHSA-jxxr-4gwj-5jf2, CVSS 6.5) where large numeric ranges bypass the documented max protection. Pulled in transitively via typescript-eslint → minimatch@10.2.4.

Changes

• package-lock.json: npm audit fix resolves brace-expansion to 5.0.6 in the typescript-eslint subtree

No package.json changes required. Dev-only impact; nothing vulnerable ships in the built extension.

└─┬ typescript-eslint@8.57.0
  └─┬ @typescript-eslint/typescript-estree@8.57.0
    └─┬ minimatch@10.2.4
      └── brace-expansion@5.0.6  ✓  (was 5.0.5)

npm audit now reports 0 vulnerabilities.

[numbers-official]

Automated Code Review (Heartbeat Deep Check)

Reviewed 1 file changed (package-lock.json).

Changes

• brace-expansion version bump: 5.0.5 → 5.0.6
• Addresses GHSA-jxxr-4gwj-5jf2 (DoS via large numeric range)

Findings

No regression risks, bugs, or security concerns found. This is a minimal, targeted dependency version bump in the lockfile only — no source code changes, no transitive dependency shifts.

Summary

Safe to merge. The change correctly resolves the tracked vulnerability (issue #87). LGTM from automated review — still requires human approval before merge.

Generated by Heart Beat with Omni