diff --git a/src/StackAlchemist.Web/audit-allowlist.json b/src/StackAlchemist.Web/audit-allowlist.json
index cce08a1..2c5debc 100644
--- a/src/StackAlchemist.Web/audit-allowlist.json
+++ b/src/StackAlchemist.Web/audit-allowlist.json
@@ -9,13 +9,5 @@
     "This file is not a way to silence a fixable finding. If `npm audit` can",
     "resolve it with an override or an upgrade, do that instead."
   ],
-  "allow": [
-    {
-      "advisory": "GHSA-mh99-v99m-4gvg",
-      "package": "brace-expansion",
-      "scope": "dev",
-      "expires": "2026-10-31",
-      "reason": "DoS via unbounded expansion length. Patched only in brace-expansion 5.0.8 — the advisory covers the entire <=5.0.7 range, so the 1.x line has no fixed release at all. Our remaining exposure is minimatch@3.1.5, which pins brace-expansion ^1.1.7 and calls it as a bare function; brace-expansion 5 is a named-export module, so forcing it there breaks eslint at runtime. minimatch@3 reaches us only through eslint 9 and the eslint-config-next plugin set (eslint-plugin-import/jsx-a11y/react), whose latest releases still pin minimatch ^3.1.2 and cap their eslint peer at 9. `npm audit fix --force` 'resolves' this by downgrading eslint-config-next from ^16.2.10 to ^0.2.4, which is not a fix. Lint-time only, never shipped to users. Revisit when the eslint-config-next plugins move off minimatch 3."
-    }
-  ]
+  "allow": []
 }
diff --git a/src/StackAlchemist.Web/package-lock.json b/src/StackAlchemist.Web/package-lock.json
index d43e629..5891f89 100644
--- a/src/StackAlchemist.Web/package-lock.json
+++ b/src/StackAlchemist.Web/package-lock.json
@@ -643,9 +643,9 @@
       "license": "MIT"
     },
     "node_modules/@eslint/config-array/node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -724,9 +724,9 @@
       "license": "MIT"
     },
     "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5138,9 +5138,9 @@
       "license": "MIT"
     },
     "node_modules/eslint-config-next/node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5411,9 +5411,9 @@
       "license": "MIT"
     },
     "node_modules/eslint/node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/src/StackAlchemist.Web/package.json b/src/StackAlchemist.Web/package.json
index 8b96a15..21a6e5e 100644
--- a/src/StackAlchemist.Web/package.json
+++ b/src/StackAlchemist.Web/package.json
@@ -61,8 +61,8 @@
     "postcss": "^8.5.18",
     "ws": "^8.20.1",
     "sharp@0": "^0.35.0",
-    "brace-expansion@1": "^1.1.16",
-    "brace-expansion@2": "^2.1.2",
+    "brace-expansion@1": "^1.1.17",
+    "brace-expansion@2": "^2.1.3",
     "brace-expansion@5": "^5.0.8"
   }
 }