chore(deps): bump brace-expansion override to 1.1.21

[VatsalSy]

Description

Dependabot alert #77 flags transitive brace-expansion 1.x below 1.1.21 (GHSA-q2hr-2g5m-vwhr, quadratic-time expansion CPU DoS). The existing npm override was pinned at 1.1.18, so the lockfile stayed on a vulnerable 1.x release.

This PR raises that override to 1.1.21 and refreshes the lockfile entry. No major-version bumps and no unrelated package updates.

Type of Change

• Other (please describe): npm security override and lockfile hygiene

Changes Made

• overrides.brace-expansion: 1.1.18 → 1.1.21 (stays on the 1.x line)
• package-lock.json: brace-expansion 1.1.18 → 1.1.21 (resolved URL + integrity)
• Other brace-expansion major lines unchanged (none separately present under the existing 1.x override)
• No site content changes

Testing Done

• npm ci
• npm ls brace-expansion — only 1.1.21 (no 1.x < 1.1.21)
• npm test (11/11 passed)
• npm run lint (js/css/md clean)
• Tested locally using bundle exec jekyll serve (Ruby not available in this environment)
• Checked all links and references
• Verified content formatting
• Cross-browser testing (if UI changes)

Related Issues

Addresses Dependabot alert #77 (brace-expansion < 1.1.21 / GHSA-q2hr-2g5m-vwhr).

Checklist

• Code follows the project's style guidelines
• All links are valid and working
• Images are optimized and properly sized
• Content is properly formatted
• Documentation has been updated (if needed)
• Changes have been tested locally

Additional Notes

Review should focus on the override pin and lockfile integrity hash for brace-expansion 1.1.21.

MERGE_READY — checks green, 0 unresolved review threads. Not merging per task stop.

  

Summary by CodeRabbit

• Chores
  • Updated the project configuration. No user-facing changes are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f0ac42dc-a5b7-4174-abf8-19eea81e217f

---

📥 Commits

Reviewing files that changed from the base of the PR and between 8d75d62 and d5ef177.

---

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

---

📒 Files selected for processing (1)

• package.json

---

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: build

---

🔇 Additional comments (1)

package.json (1)

39-39: LGTM!

---

---

📝 Walkthrough

Walkthrough

The brace-expansion override in package.json changes from version 1.1.18 to 1.1.21.

Changes

Dependency override

Layer / File(s)	Summary
Update brace-expansion override package.json	The override version changes from 1.1.18 to 1.1.21.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: comphy-bot

---

Merge Risk: ⚪ Minimal · up to d5ef1

The dependency override and lockfile are consistent, with no identified merge-blocking issue.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the dependency override update from 1.1.18 to 1.1.21.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[comphy-bot]

comphy-bot review status for comphy-lab/VatsalSy#48 at d5ef1770: completed

Review completed for this exact pull request head.

[comphy-bot]

Review: brace-expansion security override

Reviewed the exact head d5ef177: +4/-4 across package.json and package-lock.json.

The override remains an exact pin on the existing 1.x line, and the lockfile version and npm registry URL move consistently to 1.1.21 with an updated integrity value. No unrelated dependencies or executable application logic change. No P0/P1 findings identified.

Verification: the exact-head build check succeeded; the shared conflict-marker and trailing-whitespace checks passed. Deployment was skipped. Peer review threads contain no outstanding findings. No PR code or install/test scripts were executed during this review; the integrity digest was inspected in the diff, not independently verified against the registry.