fix(deps): bump brace-expansion 1.x/2.x/3.x overrides to patched versions (CVE-2026-102276/77/78)

[devin-ai-integration]

Summary

The Dependabot security-update job on main (run) fails because the lockfile still pins vulnerable brace-expansion@1.1.18 (and 2.1.4). #1928 only bumped the 5.x line; the same advisories also cover the 1.x/2.x/3.x lines, and the pnpm override floors (^1.1.18, ^2.1.4) keep Dependabot from resolving a fix:

INFO The latest possible version of brace-expansion that can be installed is 1.1.18
INFO The earliest fixed version is 1.1.21.
| security_update_not_possible | "dependency-name": "brace-expansion", "latest-resolvable-version": "1.1.18", "lowest-non-vulnerable-version": "1.1.21" |

Raise every brace-expansion override floor to the first version patched against all three advisories (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr):

-  brace-expansion@<1.1.18: ^1.1.18
-  brace-expansion@>=2.0.0 <2.1.4: ^2.1.4
-  brace-expansion@>=3.0.0 <3.0.6: ^3.0.6
-  brace-expansion@>=4.0.0 <5.0.11: ^5.0.11
+  brace-expansion@<1.1.21: ^1.1.21
+  brace-expansion@>=2.0.0 <2.1.7: ^2.1.7
+  brace-expansion@>=3.0.0 <3.0.9: ^3.0.9
+  brace-expansion@>=4.0.0 <5.0.12: ^5.0.12

Lockfile: 1.1.18 → 1.1.21, 2.1.4 → 2.1.7, 5.0.12 unchanged. All versions were published 2026-09-14, so they clear minimumReleaseAge. After the change, pnpm audit reports no brace-expansion advisories; pnpm install --frozen-lockfile and pnpm run lint pass. There's no changeset because only the workspace lockfile/overrides change, not the published package dependencies (same as #1928).

Link to Devin session: https://app.devin.ai/sessions/148d963bf68a484bb74d1c4eb9d8e332
Open in Devin Desktop: https://app.devin.ai/desktop/session/148d963bf68a484bb74d1c4eb9d8e332?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: b8b7e58

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

TASTE.md review: checked all principles (T-1–T-58). This PR only raises brace-expansion pnpm override floors in pnpm-workspace.yaml and the corresponding lockfile pins — it touches no SDK public API surface, so no rules apply. No violations found.

[github-actions]

Package Artifacts

Built from cd2e7a1. Download artifacts from this workflow run.

JS SDK (e2b@2.52.1-devin-1790937036-brace-expansion-overrides.0):

npm install ./e2b-2.52.1-devin-1790937036-brace-expansion-overrides.0.tgz

CLI (@e2b/cli@2.21.1-devin-1790937036-brace-expansion-overrides.0):

npm install ./e2b-cli-2.21.1-devin-1790937036-brace-expansion-overrides.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1790937036-brace-expansion-overrides.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1790937036-brace-expansion-overrides.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1790937036-brace-expansion-overrides.0):

npm install ./e2b-desktop-2.4.1-devin-1790937036-brace-expansion-overrides.0.tgz

Python SDK (e2b==2.52.0+devin.1790937036.brace.expansion.overrides):

pip install ./e2b-2.52.0+devin.1790937036.brace.expansion.overrides-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.1+devin.1790937036.brace.expansion.overrides):

pip install ./e2b_code_interpreter-2.10.1+devin.1790937036.brace.expansion.overrides-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.6.0+devin.1790937036.brace.expansion.overrides):

pip install ./e2b_desktop-2.6.0+devin.1790937036.brace.expansion.overrides-py3-none-any.whl

[claude]

LGTM — straightforward dependency-pin bump with no behavioral code change.

What was reviewed: the pnpm-workspace.yaml override floors for brace-expansion (1.x/2.x/3.x lines) and the corresponding pnpm-lock.yaml regeneration. Confirmed the lockfile's resolution/integrity hashes for brace-expansion@ 1.1.21 and @ 2.1.7 are present and that minimatch@ 3.1.5/5.1.9 snapshots reference the bumped versions consistently. No other brace-expansion references remain pointing at the old pinned versions, and no application source files are touched.

Extended reasoning...

The diff (64 lines total) only touches pnpm-workspace.yaml overrides and the matching pnpm-lock.yaml metadata, raising brace-expansion override floors (1.1.18->1.1.21, 2.1.4->2.1.7, 3.0.6->3.0.9, 5.0.11->5.0.12) to patch known ReDoS advisories; no application code, auth, or data-handling paths are involved. Verified the lockfile is internally consistent: new resolution hashes are present for 1.1.21 and 2.1.7, and the minimatch snapshots that depend on brace-expansion reference the bumped versions. This is mechanical, low-risk, and matches the repo's convention of pnpm-managed dependency updates with no changeset needed for a pure lockfile/override change.