fix: mitigate npm dependency advisories

api/vendor/brace-expansion-compat/README.md

@@ -0,0 +1,6 @@
+# brace-expansion compatibility adapter
+
+Older `minimatch` releases call `require('brace-expansion')` as a function,
+while the security-fixed 5.x package exposes a named `expand` function.
+This adapter preserves the legacy callable CommonJS API and delegates all
+expansion work to the bounded `brace-expansion@5.0.8` implementation.

api/vendor/brace-expansion-compat/index.cjs

@@ -0,0 +1,11 @@
+'use strict';
+
+const boundedBraceExpansion = require('brace-expansion-safe');
+
+function expand(pattern, options) {
+  return boundedBraceExpansion.expand(pattern, options);
+}
+
+Object.assign(expand, boundedBraceExpansion);
+
+module.exports = expand;

api/vendor/brace-expansion-compat/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "brace-expansion",
+  "version": "5.0.8-compat.1",
+  "private": true,
+  "description": "CommonJS compatibility adapter for the bounded brace-expansion 5.0.8 implementation",
+  "main": "index.cjs",
+  "license": "MIT",
+  "dependencies": {
+    "brace-expansion-safe": "npm:brace-expansion@5.0.8"
+  }
+}