fix: bump brace-expansion and shell-quote via pnpm overrides

[angelocordon]

Summary

Adds pnpm.overrides to force patched versions of two transitive dev-only
dependencies pulled in by @openapitools/openapi-generator-cli:

Package	Before	After	Advisory
brace-expansion	5.0.6	5.0.7	GHSA-3jxr-9vmj-r5cp
shell-quote	1.8.4	1.10.0	GHSA-395f-4hp3-45gv

• Jira: SECVULN-50771 (brace-expansion), SECVULN-50770 (shell-quote)

Root cause

brace-expansion (GHSA-3jxr-9vmj-r5cp): expand() exhibited exponential-time O(2ⁿ) behavior on consecutive non-expanding {} groups. A ~90-byte input of 30 groups blocked the event loop for ~2 minutes. Fixed in 5.0.7.

shell-quote (GHSA-395f-4hp3-45gv): parse() used Array.prototype.concat in a reduce, copying the entire growing array on each iteration — O(n²) complexity. A ~63 KB input froze the event loop for ~4.5 s, stalling all concurrent clients. Fixed in 1.9.0.

Transitive dependency chains

brace-expansion (SECVULN-50771):
@openapitools/openapi-generator-cli@2.39.1
  └─ glob@13.0.6
       └─ minimatch@10.2.5
            └─ brace-expansion 5.0.6 (vulnerable) → 5.0.7 (patched) ✅

shell-quote (SECVULN-50770):
@openapitools/openapi-generator-cli@2.39.1
  └─ concurrently@10.0.3
       └─ shell-quote 1.8.4 (vulnerable) → 1.10.0 (patched) ✅

Scope

Both packages are transitive dev dependencies only. They are never imported in production source code. There is zero production exposure.

No organic parent upgrade was available: concurrently@10.0.3 still pins shell-quote@1.8.4 and the latest @openapitools release ships the same dep tree. pnpm.overrides are used as last resort.

Files changed

• package.json — added brace-expansion: >=5.0.7 and shell-quote: >=1.9.0 to pnpm.overrides
• pnpm-lock.yaml — regenerated lockfile reflecting patched versions

Revert plan

Reverting this PR fully restores the previous state. No migrations, feature flags, or infrastructure changes are involved.

---

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  This PR is a security control improvement: it upgrades two transitive dev dependencies to their patched versions, eliminating known DoS vulnerabilities (GHSA-3jxr-9vmj-r5cp / SECVULN-50771 and GHSA-395f-4hp3-45gv / SECVULN-50770) from the dependency graph.

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}