chore(deps): update dependency minimatch@9>brace-expansion to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
minimatch@9>brace-expansion	2.1.2 → 5.0.9

---

Release Notes

juliangruber/brace-expansion (minimatch@9>brace-expansion)

v5.0.9

Compare Source

v5.0.8

Compare Source

v5.0.7

Compare Source

v5.0.6

Compare Source

v5.0.5

Compare Source

v5.0.4

Compare Source

v5.0.3

Compare Source

v5.0.2

Compare Source

v4.0.1

Compare Source

• fmt 5a5cc17
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#​65) 0b6a978

---

v4.0.0

Compare Source

• feat: use string replaces instead of splits (#​64) 278132b
• fmt dd72a59
• add tea.yaml 70e4c1b

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.6

Compare Source

v3.0.5

Compare Source

v3.0.4

Compare Source

v3.0.3

Compare Source

v3.0.2

Compare Source

v3.0.1

Compare Source

• pkg: publish on tag 3.x 3059c07
• fmt 8229e6f
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#​65) 15f9b3c

---

v3.0.0

Compare Source

• Switch to ES Modules and balanced-match 3.0.0 (#​62) c0360e8
• added jsdoc (#​55) 68c0e37
• node 16 is EOL 9e781e9
• add standard 3494c4d
• use const and let (#​57) dd5a4cb
• docs 6dad209
• remove test e3dd8ae
• ci: update node versions d23ede9
• docs: add @​lanodan to contributors 1eb3fa4
• docs 1e7c9cd
• switch from tape to test module (#​60) 2520537
• Bump minimist from 1.2.5 to 1.2.6 (#​59) 61a94f1
• Bump path-parse from 1.0.6 to 1.0.7 (#​51) dc741cf
• docs: add back ci badge 8ee5626
• Add github actions, remove travis. Closes #​52 (#​53) 5c8756a
• CI: Drop unused sudo: false Travis directive (#​50) 05978a7

v2.1.4

Compare Source

v2.1.3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[timoa]

🛑 DevSecOps Renovate sweep (TIM-117) — CI gate

Required check Lint, Test, Build & Security is failing on this PR, so the autopilot is skipping it. The CI gate requires a fully green rollup before auto-merge.

Please investigate the failing check (or re-run it after fixes) and re-trigger the sweep if appropriate.

🤖 Automated by DevSecOps autopilot

[timoa]

DevSecOps autopilot (TIM-119) — skipped: CI gate failed (cflite-pr FAILURE, Detect changes FAILURE, CodeQL-Build and dependency-review CANCELLED). minimatch@9 transitive bump via brace-expansion — patch-level but CI is broken/cancelled. Please rebase and re-run.

[timoa]

Skipping — CI is red on this PR (🚫 cflite-pr, 🚫 Detect changes, plus CodeQL-Build/dependency-review cancelled in the same run). This bumps a transitive (minimatch@9 → brace-expansion 2.1.2 → 5.0.8 — three majors at once) via a workspace pnpm catalog pin in pnpm-workspace.yaml. Not auto-merged; please triage the CI failure, and verify the v2→v5 jump for brace-expansion across the dependency tree is intended before merging.

[timoa]

Renovate PR — DevSecOps sweep (2026-08-14).

CI gate failure blocks auto-merge. Failed check(s):

• Lint, Test, Build & Security

This is a major version bump (brace-expansion 2.1.2 → 5.0.9, transitive via minimatch@9). Please fix the failing checks. The next sweep will re-evaluate once CI is green.

[timoa]

Renovate sweep — skipped, blocked. MAJOR bump (minimatch@9>brace-expansion 2.1.2 → 5.0.9) and CI gate failure: Lint, Test, Build & Security is FAILING. Major version jump (two majors!) with breaking changes (ESM-only since 3.0.0, new balancing algorithm in 4.0.0). Please investigate the failing CI and either fix and merge, or close.