deps: override npm to ^11 to clear bundled brace-expansion ReDoS
The last open Dependabot alert (brace-expansion <=2.0.1, GHSA-v6h2-p8h4-qcjw,
ReDoS) was a copy bundled inside [email protected], which @cardano-sdk/crypto pulls in
via `npm@^9.3.0`. That npm dependency is spurious — @cardano-sdk/crypto declares
it but never imports it in its compiled code — so it only drags in npm's vendored
dependency tree (including the vulnerable brace-expansion and the noise behind
`npm audit`'s large count).
A `brace-expansion` override can't fix this: npm overrides don't reach into a
bundled package's vendored node_modules, and a blanket brace-expansion override
instead downgrades the legitimate [email protected] that glob@11 / minimatch@10
require (named `expand` export), breaking glob.
Override `npm` to ^11 instead (resolves to 11.17.0), whose bundle ships the
patched [email protected]. Net effect:
- zero vulnerable brace-expansion instances remain in the tree
- glob / minimatch still resolve and brace-expand correctly
- safe because @cardano-sdk/crypto never executes npm
The lockfile was regenerated with npm 10.9.3 (matching CI's node:22-slim, not the
local npm 11) via `npm install --package-lock-only`, so it stays in sync for the
`npm ci` CI runs — npm 11 drops @auth/core's optional @simplewebauthn entries that
npm 10 keeps, which made `npm ci` fail. Churn is limited to the npm subtree.
The other 14 Dependabot alerts were already remediated in the committed lockfile
(next@16, [email protected], [email protected], ip/tar-fs absent, etc.) and dismissed.
Verified: `npm ci` (npm 10.9.3) succeeds; tsc --noEmit clean; next build --webpack succeeds.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&s=80)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&s=80)
