Remediate llm-fe npm audit critical/high vulns (#53)

Bring dependency tree from 103 vulns (4 critical / 71 high) down to 4 moderate via npm audit fix, locked transitive overrides, and a CRA-compatible brace-expansion shim. Remaining moderates need react-router v7 and leaving Create React App.
2026-07-29 19:38:47 -05:00
parent b5e16bfa6e
commit ffb5a46f30
19 changed files with 2204 additions and 1898 deletions
@@ -0,0 +1,15 @@
+'use strict';
+
+// minimatch@3 and other CRA tooling expect module.exports to be the expand
+// function (brace-expansion v1 API). Upstream 5.0.8 exports { expand } and
+// includes the GHSA-mh99-v99m-4gvg DoS limits.
+const safe = require('./lib');
+
+function expandTop(str, options) {
+  return safe.expand(str, options);
+}
+
+module.exports = expandTop;
+module.exports.expand = safe.expand;
+module.exports.EXPANSION_MAX = safe.EXPANSION_MAX;
+module.exports.EXPANSION_MAX_LENGTH = safe.EXPANSION_MAX_LENGTH;