diff --git a/.changeset/brace-expansion-advisory-5-0-9.md b/.changeset/brace-expansion-advisory-5-0-9.md
new file mode 100644
index 0000000000..4421d143e8
--- /dev/null
+++ b/.changeset/brace-expansion-advisory-5-0-9.md
@@ -0,0 +1,26 @@
+---
+---
+
+ci(deps): lift the `brace-expansion` pin to 5.0.9 so `Validate Package Dependencies` stops failing on every PR (#4945)
+
+`GHSA-rgw5-rvv9-x895` (7.5 high) affects `brace-expansion` 5.0.8 — which is
+exactly the version the previous pin (`brace-expansion@>=5.0.0 <5.0.8: ^5.0.8`,
+added for `GHSA-mh99-v99m-4gvg`) had settled on. The OSV-Scanner step in
+`.github/workflows/validate-deps.yml` reads `pnpm-lock.yaml` directly and exits
+non-zero on any match, so the job was red on `main` itself and attached that red
+to every PR that touched a manifest or the lockfile, whatever the PR contained
+(observed on #4944, which never touched `pnpm-lock.yaml`).
+
+The `pnpm-workspace.yaml` override bound moves to `<5.0.9` / `^5.0.9`. It stays a
+transitive-only pin — nothing declares `brace-expansion` directly; it arrives via
+`minimatch` (ts-morph, eslint, `@typescript-eslint`, glob, `@vscode/vsce`,
+archiver), so no published manifest changes and `check-override-consistency`
+still has nothing to reconcile. 5.0.8 disappears from the lockfile entirely; the
+three `minimatch` snapshots that referenced it now resolve 5.0.9.
+
+The reason to fix this on its own rather than let it ride along with the next
+dependency PR is the one the issue names: a permanently red required check
+trains everyone to scroll past it, and the next real advisory will look exactly
+like this one in the PR list.
+
+Lockfile and override metadata only; releases nothing.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dae7bbe9ab..23b6cf2a79 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -26,7 +26,7 @@ overrides:
   cookie@<0.7.0: 0.7.0
   svelte: ^5.55.7
   '@tootallnate/once@<2.0.1': 2.0.1
-  brace-expansion@>=5.0.0 <5.0.8: ^5.0.8
+  brace-expansion@>=5.0.0 <5.0.9: ^5.0.9
   sharp@>=0.34.0 <0.35.0: ^0.35.0
   react-router@<8.3.0: ^8.3.0
   '@sveltejs/kit@<2.69.1': ^2.69.1
@@ -5219,10 +5219,6 @@ packages:
   bowser@2.14.1:
     resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
-    engines: {node: 20 || >=22}
-
   brace-expansion@5.0.9:
     resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
@@ -12067,10 +12063,6 @@ snapshots:
 
   bowser@2.14.1: {}
 
-  brace-expansion@5.0.8:
-    dependencies:
-      balanced-match: 4.0.4
-
   brace-expansion@5.0.9:
     dependencies:
       balanced-match: 4.0.4
@@ -14563,11 +14555,11 @@ snapshots:
 
   minimatch@10.2.3:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
 
   minimatch@10.2.6:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 9997bf53a2..33ebda0ddf 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -105,13 +105,16 @@ overrides:
   svelte: '^5.55.7'
   '@tootallnate/once@<2.0.1': '2.0.1'
   # OSV batch 2026-07 — transitive-only fixes (no publishable package declares these):
-  # brace-expansion GHSA-mh99-v99m-4gvg (via minimatch@10.x); sharp GHSA-f88m-g3jw-g9cj
+  # brace-expansion GHSA-mh99-v99m-4gvg (via minimatch@10.x), then GHSA-rgw5-rvv9-x895
+  # (7.5 high) which affects 5.0.8 itself — the version the first pin landed on — so the
+  # bound moves to <5.0.9. Still transitive-only through minimatch (ts-morph, eslint,
+  # @typescript-eslint, glob, @vscode/vsce, archiver); sharp GHSA-f88m-g3jw-g9cj
   # (next optionalDep ^0.34.5 excludes the fix); react-router GHSA-qwww-vcr4-c8h2 has no
   # 7.x fix — fumadocs-core peer allows 8.x and docs uses the next adapter, so jump to 8;
   # @sveltejs/kit GHSA-866w-xmhq-wj7x/GHSA-wqjv-9729-c5q2 (better-auth optional peer);
   # @hono/node-server GHSA-frvp-7c67-39w9 has no 1.x fix — @modelcontextprotocol/sdk
   # declares ^1.19.9 and only imports getRequestListener, which 2.x still exports.
-  'brace-expansion@>=5.0.0 <5.0.8': '^5.0.8'
+  'brace-expansion@>=5.0.0 <5.0.9': '^5.0.9'
   'sharp@>=0.34.0 <0.35.0': '^0.35.0'
   'react-router@<8.3.0': '^8.3.0'
   '@sveltejs/kit@<2.69.1': '^2.69.1'