fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149)

[anupamme]

Summary

Upgrade brace-expansion from 2.0.3 to 5.0.7, 1.1.16, 2.1.2 to fix CVE-2026-13149.

Vulnerability

Field	Value
ID	CVE-2026-13149
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-13149
File	package-lock.json
Assessment	Likely exploitable

Description: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

Evidence

Scanner confirmation: trivy rule CVE-2026-13149 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• package.json
• package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)