chore(security): shim minimatch instead of brace-expansion

Der vorherige Ansatz hat brace-expansion selbst ersetzt. Das funktioniert
zwar technisch, der Dependency-Review-Scan sieht das Paket aber weiterhin
als brace-expansion 1.x und schlägt an. Die Version künstlich über 5.0.7
zu heben wäre nur Kosmetik gegenüber dem Scanner.

Stattdessen jetzt an der richtigen Stelle angesetzt: minimatch wird per
resolutions auf einen Shim gemappt, der minimatch 10 unter der callable
minimatch@3 API bereitstellt. minimatch 10 hängt selbst schon an
brace-expansion ^5.0.5, damit löst brace-expansion regulär auf 5.0.8 auf
und die verwundbare 1.x-Linie ist komplett aus dem Baum. Nichts wird
maskiert, das Paket ist echt gepatcht.

Beide Consumer (serve-handler, docusaurus-lunr-search) rufen minimatch
ausschließlich als Funktion auf. Ein A/B-Vergleich gegen echtes
minimatch 3.1.5 über neun Glob-, Globstar- und Brace-Patterns liefert
identische Ergebnisse.

Geprüft mit yarn typecheck, yarn build inklusive lunr-Indexierung
(unverändert 37 Dokumente) und einem serve-handler-Smoketest, bei dem
das Header-Glob-Matching über minimatch tatsächlich greift.

Geänderte Dateien:
- package.json
- yarn.lock
- patches/minimatch-compat/package.json (neu)
- patches/minimatch-compat/index.js (neu)
- patches/brace-expansion-compat/ (entfernt)

Author: Musiker15

package.json

@@ -41,7 +41,7 @@
     "serialize-javascript": "^7.0.5",
     "follow-redirects": "^1.16.0",
     "@babel/plugin-transform-modules-systemjs": "^7.29.4",
-    "brace-expansion": "file:./patches/brace-expansion-compat",
+    "minimatch": "file:./patches/minimatch-compat",
     "qs": "^6.15.3",
     "**/sockjs/uuid": "^11.1.1",
     "**/webpack-bundle-analyzer/ws": "^7.5.11",

patches/brace-expansion-compat/index.js

@@ -0,0 +1,36 @@
+'use strict';
+
+// Why this exists:
+//
+// brace-expansion 1.x is affected by GHSA-mh99-v99m-4gvg (unbounded expansion,
+// OOM crash) and the 1.x line never got a patch. The fix only landed in 5.0.8.
+// The only thing still pulling brace-expansion 1.x is minimatch@3, which
+// serve-handler and docusaurus-lunr-search depend on.
+//
+// brace-expansion 5 cannot be dropped into minimatch@3 because its CommonJS
+// build exports an object instead of a callable. Going the other way works
+// though: minimatch 10 already depends on the patched brace-expansion 5.x. Its
+// own CommonJS build is not callable either, but that is easy to bridge, and
+// unlike brace-expansion the API surface here is small and stable.
+//
+// So this shim is mapped over "minimatch" via yarn resolutions. Result:
+// minimatch@3 is gone, brace-expansion resolves to a patched 5.x, and the two
+// consumers keep the callable signature they expect.
+
+const mm = require('minimatch-modern');
+
+const minimatch = mm.minimatch;
+
+// minimatch@3 hangs its extras off the exported function (Minimatch, filter,
+// match, makeRe, braceExpand, defaults, sep, GLOBSTAR). Carry them over so the
+// shim is shaped like the module it replaces.
+for (const key of Object.keys(mm)) {
+  if (key === 'minimatch') continue;
+  try {
+    minimatch[key] = mm[key];
+  } catch (err) {
+    // read-only function properties (name, length) are not overwritable
+  }
+}
+
+module.exports = minimatch;

patches/brace-expansion-compat/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "minimatch-compat",
+  "version": "3.1.6",
+  "description": "CommonJS compat shim: serves minimatch 10 under the callable minimatch@3 API, so the tree can drop the unpatchable brace-expansion 1.x.",
+  "license": "ISC",
+  "main": "index.js",
+  "files": [
+    "index.js"
+  ],
+  "dependencies": {
+    "minimatch-modern": "npm:minimatch@^10.2.5"
+  },
+  "engines": {
+    "node": ">=20.0"
+  }
+}

patches/minimatch-compat/index.js

@@ -2151,18 +2151,6 @@
   dependencies:
     "@hapi/hoek" "^9.0.0"
 
-"@isaacs/balanced-match@^4.0.1":
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz#3081dadbc3460661b751e7591d7faea5df39dd29"
-  integrity sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==
-
-"@isaacs/brace-expansion@^5.0.1":
-  version "5.0.1"
-  resolved "https://registry.yarnpkg.com/@isaacs/brace-expansion/-/brace-expansion-5.0.1.tgz#0ef5a92d91f2fff2a37646ce54da9e5f599f6eff"
-  integrity sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ==
-  dependencies:
-    "@isaacs/balanced-match" "^4.0.1"
-
 "@jest/schemas@^29.6.3":
   version "29.6.3"
   resolved "https://registry.yarnpkg.com/@jest/schemas/-/schemas-29.6.3.tgz#430b5ce8a4e0044a7e3819663305a7b3091c8e03"
@@ -3824,6 +3812,11 @@ bail@^2.0.0:
   resolved "https://registry.yarnpkg.com/bail/-/bail-2.0.2.tgz#d26f5cd8fe5d6f832a31517b9f7c356040ba6d5d"
   integrity sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==
 
+balanced-match@^4.0.2:
+  version "4.0.4"
+  resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-4.0.4.tgz#bfb10662feed8196a2c62e7c68e17720c274179a"
+  integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==
+
 baseline-browser-mapping@^2.10.12:
   version "2.10.17"
   resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.17.tgz#435c101835c314c2d89d768795e1ea79941fafd3"
@@ -3908,10 +3901,12 @@ boxen@^7.0.0:
     widest-line "^4.0.1"
     wrap-ansi "^8.1.0"
 
-brace-expansion@^1.1.7, "brace-expansion@file:./patches/brace-expansion-compat":
-  version "1.1.17"
+brace-expansion@^5.0.5:
+  version "5.0.8"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.8.tgz#135ad0d8d808eb18eb5e0ec9a21f3a0b92ef18cf"
+  integrity sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==
   dependencies:
-    "@isaacs/brace-expansion" "^5.0.1"
+    balanced-match "^4.0.2"
 
 braces@^3.0.3, braces@~3.0.2:
   version "3.0.3"
@@ -7277,12 +7272,17 @@ minimalistic-assert@^1.0.0:
   resolved "https://registry.yarnpkg.com/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz#2e194de044626d4a10e7f7fbc00ce73e83e4d5c7"
   integrity sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==
 
-minimatch@3.1.5, minimatch@^3.1.2:
-  version "3.1.5"
-  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.5.tgz#580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e"
-  integrity sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==
+"minimatch-modern@npm:minimatch@^10.2.5":
+  version "10.2.5"
+  resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.5.tgz#bd48687a0be38ed2961399105600f832095861d1"
+  integrity sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==
+  dependencies:
+    brace-expansion "^5.0.5"
+
+minimatch@3.1.5, minimatch@^3.1.2, "minimatch@file:./patches/minimatch-compat":
+  version "3.1.6"
   dependencies:
-    brace-expansion "^1.1.7"
+    minimatch-modern "npm:minimatch@^10.2.5"
 
 minimist@^1.2.0:
   version "1.2.8"