Fix brace-expansion DoS CVE-2026-13149 via overrides

[msrathore-db]

What & why

Resolves the two brace-expansion DoS findings surfaced by OSV-Scanner. brace-expansion is a dev-only transitive dependency (pulled in via minimatch under eslint/eslint-plugin-*/mocha/nyc — all devDependencies) and is not bundled in the shipped dist/ (see .npmignore), so exposure is limited to the local lint/test toolchain.

Fixed

• CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp (HIGH, exponential-time expansion DoS) — pinned brace-expansion@1 -> 1.1.16 and @2 -> 2.1.2 via package.json overrides. Confirmed cleared by a rescan.

Left unsuppressed (no fix available)

• CVE-2026-14257 / GHSA-mh99-v99m-4gvg (HIGH, unbounded-expansion OOM DoS) has no published fix: the fixed version 5.0.8 is not on npm (latest across all lines is 2.1.2; npm view brace-expansion@5.0.8 → 404), and its affected range is <= 5.0.7, i.e. every published version. It is intentionally left unsuppressed so the scan keeps surfacing it and it gets remediated as soon as a fix is published. osv-scanner.toml carries a documentation-only note explaining this (no [[IgnoredVulns]] entry).

Note: because CVE-2026-14257 is CVSS 7.5 and unfixable today, the Security Scan gate will report it until upstream publishes 5.0.8. This is expected and intentional.

Verification

• OSV-Scanner: CVE-2026-13149 no longer appears on the bumped versions.
• E2E suite against a live warehouse: 106 passing, 0 failing (3 pending — the interactive OAuth U2M harness, always skipped).

This pull request and its description were written by Isaac.

[peco-review-bot]

Verdict: 1 High

The override pins (brace-expansion@1 -> 1.1.16, @2 -> 2.1.2), osv-scanner note, and CHANGELOG entry are correct and well-documented. One HIGH issue: the regenerated lockfile resolves the new brace-expansion tarballs against an internal npm-proxy.dev.databricks.com host instead of public npm, which will break npm ci for external contributors.

[peco-review-bot]

🟠 High — The 4 brace-expansion entries added/updated by this PR resolve to an internal Databricks host (https://npm-proxy.dev.databricks.com/...), while every other entry in package-lock.json resolves to the public https://registry.npmjs.org. This is a widely-consumed open-source connector; external contributors and public CI running npm ci will attempt to fetch these tarballs from npm-proxy.dev.databricks.com, which is not resolvable outside the Databricks network — breaking clean installs for anyone outside the internal network.

The lockfile was almost certainly regenerated against an internal proxy registry. Re-run the install with the public registry (e.g. npm install --registry=https://registry.npmjs.org) so the resolved URLs point at public npm, then commit. The integrity hashes should be identical since the tarball contents are the same.

Affected lines: 1864 (1.1.16), 4790 (2.1.2), 8113 (1.1.16), 10208 (2.1.2).