fix(deps): bump brace-expansion to 5.0.9 in apps/web (#50)

[vianbas]

Summary

Bumps brace-expansion from 5.0.6 to 5.0.9 in apps/web, which fixes three high-severity DoS advisories. Dependabot's #39 only goes to 5.0.7, which fixes the first of them and leaves the other two open.

Closes #50

Supersedes #39.

Advisory	Issue	Fixed in
GHSA-3jxr-9vmj-r5cp	Exponential-time expansion of consecutive non-expanding {} groups	5.0.7
GHSA-mh99-v99m-4gvg	Unbounded expansion length, leading to an out-of-memory crash	5.0.8
GHSA-rgw5-rvv9-x895	Unbounded intermediate arrays, bypassing the earlier mitigation	5.0.9

GitHub auto-dismissed the Dependabot alerts for the last two advisories because brace-expansion is development-only. npm audit still reported them.

Architecture summary

• Only apps/web/package-lock.json changes. The update came from npm update brace-expansion, and package.json is untouched.
• brace-expansion is a transitive dev dependency. The ESLint toolchain pulls it in through minimatch 10.2.5, which accepts ^5.0.5. None of it ends up in the built app.

Lockfile changes

Compared with main, one package version changes, and nothing is added or removed:

brace-expansion: 5.0.6 -> 5.0.9

Security considerations

• All three advisories are denial-of-service bugs in brace expansion. They can only be reached through build and lint tooling, never at runtime. Fixing them keeps npm audit meaningful for development dependencies too.
• There's no new dependency and no code change.

Testing evidence

• npm ci, lint, tsc --noEmit, vitest (17/17) and vite build all pass.
• The built assets are byte-identical to main's (index-C9FYIbTn.css, index-DB_pI0PC.js).
• npm audit no longer lists brace-expansion.
• git diff --check is clean.

$ make verify
ok  	github.com/vianbas/finwatch/apps/api/...   (all 13 Go packages ok, incl. DB-backed store tests)
 Test Files  6 passed (6)
      Tests  17 passed (17)
✓ built in 260ms

Known limitations

• None expected. Other advisories are tracked separately: browserslist and baseline-browser-mapping in chore(deps): bump browserslist from 4.28.2 to 4.28.9 in /apps/web #44, vitest and @vitest/mocker in chore(deps): bump @vitest/mocker and vitest in /apps/web #45, postcss-selector-parser in chore(deps): bump postcss-selector-parser from 6.1.2 to 6.1.4 in /apps/web #43.

Follow-up issues

• Close chore(deps): bump brace-expansion from 5.0.6 to 5.0.7 in /apps/web #39 as superseded once this is open.

Checklist

• Branch is not main; this PR targets main.
• Conventional commit message.
• make verify passes locally.
• git diff --check is clean.
• No secrets, real/personal data, or proprietary references.
• Contracts updated first where applicable (OpenAPI/AsyncAPI) — n/a, no contract change.
• Docs updated to match the change — n/a, no doc mentions this dependency.