fix(deps): bump brace-expansion 1.x/2.x/3.x/5.x overrides to patched versions

[devin-ai-integration]

Summary

The Dependabot security-update job on main (job 110810174316) fails because the workspace override pins brace-expansion 1.x below the fixed version, so Dependabot can't bump it:

INFO The latest possible version of brace-expansion that can be installed is 1.1.18
INFO The earliest fixed version is 1.1.21.
| security_update_not_possible | "dependency-name": "brace-expansion",
|                              | "latest-resolvable-version": "1.1.18",
|                              | "lowest-non-vulnerable-version": "1.1.21",

#1928 raised only the 5.x override. The same advisories (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr) also cover the 1.x/2.x/3.x lines, and the open Dependabot alerts (#387–#394) still flag them. This PR raises every override floor to the version that clears all three advisories:

 # pnpm-workspace.yaml overrides
-  brace-expansion@<1.1.18: ^1.1.18
-  brace-expansion@>=2.0.0 <2.1.4: ^2.1.4
-  brace-expansion@>=3.0.0 <3.0.6: ^3.0.6
-  brace-expansion@>=4.0.0 <5.0.11: ^5.0.11
+  brace-expansion@<1.1.21: ^1.1.21
+  brace-expansion@>=2.0.0 <2.1.7: ^2.1.7
+  brace-expansion@>=3.0.0 <3.0.9: ^3.0.9
+  brace-expansion@>=4.0.0 <5.0.12: ^5.0.12
 # pnpm-lock.yaml
-brace-expansion 1.1.18 / 2.1.4
+brace-expansion 1.1.21 / 2.1.7   (5.0.12 unchanged)

All target versions were published 2026-09-14, so they fall outside the 3-day minimumReleaseAge. 1.x/2.x reach the repo only through dev dependencies (npm-run-all, openapi-typescript), and lockfile/workspace overrides aren't published, so there is no changeset (same as #1928).

Verified locally: pnpm install --frozen-lockfile succeeds, pnpm audit reports nothing for brace-expansion, tests/template/utils passes (81 passed, 3 skipped), and pnpm --dir packages/js-sdk run typecheck passes.

Link to Devin session: https://app.devin.ai/sessions/967351cbda7f4b25b64e4adc3b229bbc
Open in Devin Desktop: https://app.devin.ai/desktop/session/967351cbda7f4b25b64e4adc3b229bbc?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 59ad092

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

TASTE.md review: complies, no violations. This PR only bumps the brace-expansion overrides in pnpm-workspace.yaml/pnpm-lock.yaml, and none of the TASTE.md principles (parity, API shape, streaming, lifecycle, template builder, timeouts, config, module structure, errors, deprecation, docs) cover that.

Written by Devin

[github-actions]

Package Artifacts

Built from 39c445c. Download artifacts from this workflow run.

JS SDK (e2b@2.52.1-devin-1790938795-brace-expansion-1x-2x.0):

npm install ./e2b-2.52.1-devin-1790938795-brace-expansion-1x-2x.0.tgz

CLI (@e2b/cli@2.21.1-devin-1790938795-brace-expansion-1x-2x.0):

npm install ./e2b-cli-2.21.1-devin-1790938795-brace-expansion-1x-2x.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1790938795-brace-expansion-1x-2x.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1790938795-brace-expansion-1x-2x.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1790938795-brace-expansion-1x-2x.0):

npm install ./e2b-desktop-2.4.1-devin-1790938795-brace-expansion-1x-2x.0.tgz

Python SDK (e2b==2.52.0+devin.1790938795.brace.expansion.1x.2x):

pip install ./e2b-2.52.0+devin.1790938795.brace.expansion.1x.2x-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.1+devin.1790938795.brace.expansion.1x.2x):

pip install ./e2b_code_interpreter-2.10.1+devin.1790938795.brace.expansion.1x.2x-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.6.0+devin.1790938795.brace.expansion.1x.2x):

pip install ./e2b_desktop-2.6.0+devin.1790938795.brace.expansion.1x.2x-py3-none-any.whl

[claude]

Looks good, straightforward dependency-override version bump.

What was reviewed: confirmed the pnpm-workspace.yaml override thresholds for brace-expansion were raised (1.1.18→1.1.21, 2.1.4→2.1.7, 3.0.6→3.0.9, 5.0.11→5.0.12) and that pnpm-lock.yaml was regenerated consistently — new resolution hashes for brace-expansion@ 1.1.21/2.1.7 and updated minimatch@ 3.1.5/5.1.9 dependency pins match the new versions. No other packages, code, or specs are touched; diff is 24/8 lines across exactly the two listed files.

Extended reasoning...

Pure dependency-security patch: raises pnpm override floors for brace-expansion in pnpm-workspace.yaml and regenerates pnpm-lock.yaml accordingly, touching no application code, specs, or public API surface. No security-sensitive logic is introduced (the change only tightens version constraints to pull in already-patched upstream releases); verified the lockfile hashes/snapshots are internally consistent with the new versions. Small, mechanical, and self-contained, matching the PR description exactly.

[mishushakov]

is this already merged?

[devin-ai-integration]

Yes. #1929 (a9d17ce) landed on main with the same change while this PR was open. main now has the overrides at ^1.1.21 / ^2.1.7 / ^3.0.9 / ^5.0.12, and the lockfile resolves to 1.1.21 / 2.1.7 / 5.0.12. Closing this as a duplicate.