fix: update brace-expansion to resolve CVE-2026-13149

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln

• Dependency: brace-expansion updated from 1.1.11 → 5.0.8 (via npm overrides in build_ts/package.json)
• Advisory: GHSA-3jxr-9vmj-r5cp
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-13149
• Dependabot alert: https://github.com/warpdotdev/workflows/security/dependabot/33
• Verification: npm install ran successfully (includes tsc && webpack build); npm audit no longer reports brace-expansion vulnerability

Highlight the risky code / where the dependency was used

brace-expansion is a transitive dependency of minimatch (brought in via nodemon devDependency). It is only used in the build toolchain, not in the shipped bundle. Risk is low.

Special instructions for this PR

None. This is a devDependency-only change to build_ts/. The overrides field pins brace-expansion to >=1.1.16 (resolved to 5.0.8 at time of install).

AFTER YOU MERGE

No post-merge steps required.

[dannyneira]

Holding off on approval and merge for now:

• Major version bump: brace-expansion is being updated from 1.1.11 to 5.0.8, which crosses multiple major version boundaries (1.x to 5.x). Major bumps may include breaking changes; recommend merging separately after confirming the build toolchain (nodemon/minimatch) still behaves as expected with the pinned version.
• CI is currently green and changes are limited to build_ts/package.json and build_ts/package-lock.json (manifest/lockfile only), which is good.

Per review policy, major-version dependency bumps are not auto-merged. Please verify the bump is safe for the build toolchain and merge manually if appropriate.

[dannyneira]

Verified locally on a fresh clone of warpdotdev/workflows with this PR branch checked out (Node v24.15.0, npm 11.12.1).

Install: npm ci in build_ts/ succeeded (186 packages; brace-expansion resolved to 5.0.8 per the overrides block, balanced-match to 4.0.4). The repo's own prepare script (npm run build) ran during install and completed.

Build: npm run build (tsc && webpack) passed — "webpack 5.107.2 compiled successfully"; dist/warp-workflows.js (243 KiB), index.d.ts, index.js, and index.js.map emitted.

Typecheck: npx tsc --noEmit passed with no errors.

Lint / test: no lint or test scripts are defined in build_ts/package.json, so those steps are not applicable.

prepare script review (called out in the Dependabot release notes): brace-expansion 5.0.8 declares "prepare": "tshy". tshy is a standard, dev-only TypeScript dual-package build tool; npm does not run prepare for registry-installed dependencies, and tshy is listed under devDependencies (not installed transitively), so this script does not execute during npm ci. The published tarball ships pre-built dist/. No unexpected install-time behavior observed. (The transitive balanced-match@4.0.4 has the same benign prepare: tshy pattern.) brace-expansion is a transitive dependency via nodemon and is not part of the build output.

All defined verification steps pass. Safe to merge.