@lenne.tech/cli 1.50.0 → 1.50.2

package/build/commands/npm/reinit.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const reinit_command_1 = require("../../lib/reinit-command");
 /**
  * Reinitialize npm packages
  */
@@ -83,8 +84,11 @@ const NewCommand = {
             if (system.which('rimraf')) {
                 yield system.run(pm.globalInstall('rimraf'));
             }
-            const lockfile = pm.getLockfileName(detectedPm);
-            yield system.run(`cd ${(0, path_1.dirname)(path)} && rimraf ${lockfile} && rimraf node_modules && ${pm.cacheClean(detectedPm)} && ${pm.install(detectedPm)}`);
+            yield system.run((0, reinit_command_1.buildReinitCommand)({
+                dir: (0, path_1.dirname)(path),
+                install: pm.install(detectedPm),
+                lockfile: pm.getLockfileName(detectedPm),
+            }));
             reinitSpin.succeed();
             if (data.scripts && data.scripts['test:e2e']) {
                 const testE2eSpin = spin('Run tests');

package/build/config/vendor-runtime-deps.json

@@ -1,4 +1,4 @@
 {
-  "$comment": "Upstream @lenne.tech/nest-server DEVDEPENDENCIES that must land in a vendored project's `dependencies`. Vendoring copies upstream `dependencies` verbatim and does not read `peerDependencies` at all, so a package the framework imports at runtime while keeping it in devDependencies would never reach the production runtime. Entries here are matched against upstream `devDependencies` only — see `isVendorRuntimeDep`, consulted in the `upstreamDevDeps` loop in `extensions/server.ts` — and promoted into `dependencies`, preferring the upstream peer RANGE over the exact devDep pin where one exists, so a generated project still receives patch-level security fixes. A package that appears ONLY in upstream `peerDependencies` cannot be promoted by this list: listing it here is a silent no-op. Two live cases: `find-file-up` (imported by the config loader, devDependency only), and the better-auth trio (declared as peerDependencies AND mirrored into devDependencies upstream; the mirror is what makes the promotion fire, so this list is the fallback if the starter ever stops declaring them itself).",
-  "runtimeHelpers": ["@better-auth/core", "@better-auth/passkey", "better-auth", "find-file-up"]
+  "$comment": "Upstream @lenne.tech/nest-server DEVDEPENDENCIES that must land in a vendored project's `dependencies`. Vendoring copies upstream `dependencies` verbatim and does not read `peerDependencies` at all, so a package the framework imports at runtime while keeping it in devDependencies would never reach the production runtime. Entries here are matched against upstream `devDependencies` only — see `isVendorRuntimeDep`, consulted in the `upstreamDevDeps` loop in `extensions/server.ts` — and promoted into `dependencies`, preferring the upstream peer RANGE over the exact devDep pin where one exists, so a generated project still receives patch-level security fixes. A package that appears ONLY in upstream `peerDependencies` cannot be promoted by this list: listing it here is a silent no-op. One live case: the better-auth trio (declared as peerDependencies AND mirrored into devDependencies upstream; the mirror is what makes the promotion fire, so this list is the fallback if the starter ever stops declaring them itself). `find-file-up` was listed here until 2026-10-03 and never needed: no nest-server release from 8.x to 11.x imports it from src/ (only the dev script extras/sync-version.ts did), and 11.41.8 dropped the package altogether.",
+  "runtimeHelpers": ["@better-auth/core", "@better-auth/passkey", "better-auth"]
 }

package/build/extensions/package-manager.js

@@ -43,21 +43,6 @@ class PackageManager {
         const manager = pm || this.detect();
         return manager;
     }
-    /**
-     * Get the cache clean command
-     * @param pm - Override detected package manager
-     */
-    cacheClean(pm) {
-        const manager = pm || this.detect();
-        switch (manager) {
-            case 'pnpm':
-                return 'pnpm store prune';
-            case 'yarn':
-                return 'yarn cache clean';
-            default:
-                return 'npm cache clean --force';
-        }
-    }
     /**
      * Detect the package manager for the given directory
      * Uses caching per directory for performance

package/build/extensions/server.js

@@ -1919,8 +1919,8 @@ class Server {
      * dep in disguise that needs to live in `dependencies` after vendoring?
      *
      * `@lenne.tech/nest-server` keeps a few packages in devDependencies that
-     * the framework code imports at runtime (e.g. `find-file-up` in its
-     * config loader). When we vendor the framework source into a consumer
+     * the framework code imports at runtime (e.g. the better-auth trio, which
+     * it mirrors from peerDependencies). When we vendor the framework source into a consumer
      * project, those must end up in `dependencies` so the compiled/dist
      * runtime has them available.
      *

package/build/lib/dev-log-tail.js

@@ -37,14 +37,23 @@ function describeLog(d) {
     }
     return [`Last lines of ${d.file}:`, ...d.tail.map((l) => `  ${l}`)];
 }
-/** Read `file` and keep its last `lines` non-empty lines. */
-function diagnoseLog(file, lines = 20) {
+/**
+ * How much of a log's end is read. A dev log reached 1 GB (Vue warnings carry
+ * serialized vnode traces of several MB each), and reading all of it to show 20
+ * lines threw "Cannot create a string longer than 0x1fffffe8 characters".
+ */
+const TAIL_BYTES = 64 * 1024;
+/** Longest line shown: one of those traces would otherwise flood the terminal. */
+const MAX_LINE_LENGTH = 500;
+/** Read the end of `file` and keep its last `lines` non-empty lines. */
+function diagnoseLog(file, lines = 20, maxBytes = TAIL_BYTES) {
     if (!(0, fs_1.existsSync)(file))
         return { file, size: -1, state: 'missing', tail: [] };
     const size = (0, fs_1.statSync)(file).size;
     if (size === 0)
         return { file, size, state: 'empty', tail: [] };
-    return { file, size, state: 'ok', tail: tailLines((0, fs_1.readFileSync)(file, 'utf8'), lines) };
+    const tail = tailLines(readEnd(file, size, maxBytes), lines).map((l) => l.length > MAX_LINE_LENGTH ? `${l.slice(0, MAX_LINE_LENGTH)}…` : l);
+    return { file, size, state: 'ok', tail };
 }
 /**
  * Components whose pid is gone within `budgetMs` of their start.
@@ -89,3 +98,24 @@ function tailLines(content, n) {
         .filter((l) => l.trim().length > 0)
         .slice(-n);
 }
+/**
+ * The last `maxBytes` of `file`. The first line of a cut window is partial and
+ * dropped, unless the window lies inside one line: then the fragment is kept,
+ * marked with a leading `…`.
+ */
+function readEnd(file, size, maxBytes) {
+    const length = Math.min(size, maxBytes);
+    const buffer = Buffer.alloc(length);
+    const fd = (0, fs_1.openSync)(file, 'r');
+    try {
+        (0, fs_1.readSync)(fd, buffer, 0, length, size - length);
+    }
+    finally {
+        (0, fs_1.closeSync)(fd);
+    }
+    const text = buffer.toString('utf8');
+    if (length === size)
+        return text;
+    const rest = text.slice(text.indexOf('\n') + 1);
+    return text.includes('\n') && rest.trim() ? rest : `…${text}`;
+}

package/build/lib/dev-patches.js

@@ -180,7 +180,18 @@ function patchClaudeMd(file, options) {
     if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
         const before = content.slice(0, startIdx);
         const after = content.slice(endIdx + endMarker.length);
-        next = before + block + after;
+        // Anything between the markers that is NOT this generated block is somebody's own writing,
+        // and it is kept — moved out in front of the block rather than overwritten.
+        //
+        // Replacing the span wholesale was silent data loss, observed in `offers`: a 29-line section
+        // of project documentation sat between the markers and one `lt dev up` deleted it, reporting
+        // only "updated CLAUDE.md URL block in 1 file(s)". Nothing about the markers suggests the
+        // span is owned — they are HTML comments, so they are invisible in every rendered view of the
+        // file, and a section appended after the preceding one lands inside them without anyone
+        // seeing it. The only reason it was noticed at all is that the file happened to be under
+        // review in the same minute.
+        const rescued = rescueForeignContent(content.slice(startIdx + startMarker.length, endIdx));
+        next = before + (rescued ? `${rescued}\n\n` : '') + block + after;
     }
     else {
         const sep = content.endsWith('\n\n') ? '' : content.endsWith('\n') ? '\n' : '\n\n';
@@ -427,3 +438,26 @@ function normaliseBridgeBlock(s) {
         .replace(/\s+/g, ' ')
         .trim();
 }
+/**
+ * Pull out the sections between the lt-dev markers that this tool did not write.
+ *
+ * The generated block is one section, `## Local Development (lt dev)`. Every other `##` section
+ * found inside the markers was written by somebody else and is returned so the caller can place
+ * it outside the block. Whitespace-only remainders are dropped — that is the generated block's
+ * own padding, not content.
+ *
+ * Deliberately conservative about what counts as ours: a section is discarded only when its
+ * heading matches exactly. A renamed or hand-edited heading is treated as foreign and kept, which
+ * leaves a duplicate for a human to resolve. A duplicate is visible; a deletion is not.
+ */
+function rescueForeignContent(span) {
+    const own = '## Local Development (lt dev)';
+    const sections = span.split(/\n(?=## )/);
+    // Compare the whole heading line, not a prefix: `## Local Development (lt dev) — notes` is a
+    // section somebody wrote next to ours, and a prefix match would delete it.
+    const foreign = sections
+        .filter((section) => section.trimStart().split(/\r?\n/, 1)[0].trim() !== own)
+        .map((section) => section.trim())
+        .filter(Boolean);
+    return foreign.join('\n\n');
+}

package/build/lib/reinit-command.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReinitCommand = buildReinitCommand;
+/**
+ * Shell command for `lt npm reinit` in a project without its own `reinit` script:
+ * remove the lockfile and node_modules, then install fresh.
+ *
+ * Deliberately no cache step. `pnpm store prune` empties the machine-wide store on APFS
+ * (clone imports leave every store file with link count 1, which is exactly what prune
+ * deletes), and `npm cache clean --force` / `yarn cache clean` wipe the shared caches the
+ * same way — every other project then downloads again, and a parallel install loses the
+ * files it is linking. A fresh resolution needs neither: deleting the lockfile is what
+ * makes the package manager ask the registry again, and pnpm verifies store integrity
+ * on every install.
+ */
+function buildReinitCommand(opts) {
+    const { dir, install, lockfile } = opts;
+    return `cd ${dir} && rimraf ${lockfile} && rimraf node_modules && ${install}`;
+}

package/build/templates/check/check.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// @lt-check-wrapper 3.13.1
+// @lt-check-wrapper 3.14.1
 /**
  * Quiet, report-driven wrapper around the project `check` pipeline.
  *
@@ -33,7 +33,7 @@
  * scripts/check-wrapper-version.test.mjs fails when it drifts from
  * package.json. In a generated project it keeps the release it came from.
  */
-import { execFileSync, execSync, spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -430,7 +430,21 @@ const IDLE_TIMEOUT_MS = (() => {
 const RUNNING = new Set();
 
 /**
- * How to kill a process tree on this platform.
+ * Whether a number may become a kill target at all.
+ *
+ * A spawn that failed leaves `child.pid` undefined. On POSIX that only made `pgrep` and
+ * `process.kill` throw, but on Windows it became `taskkill /PID undefined /T /F` — a kill
+ * command built from a word that is not a pid. And the small numbers are not processes you
+ * own: POSIX pid 1 is init/launchd, and 0 and -1 are the group and the kill(2) broadcast to
+ * every process of the user (the shape that rebooted a Mac on 2026-09-23). Windows reserves
+ * 0 (System Idle) and 4 (System). Nothing a check step spawns can have any of these pids.
+ */
+export function isKillablePid(pid, platform = process.platform) {
+  return Number.isInteger(pid) && pid > (platform === 'win32' ? 4 : 1);
+}
+
+/**
+ * How to kill a process tree on this platform, or null when `pid` must not be touched.
  *
  * Windows has neither `pgrep` nor signals: `process.kill(pid, 'SIGTERM')` there ends the one
  * process and orphans its children, and `taskkill /T` alone was measured to leave the tree
@@ -445,46 +459,85 @@ const RUNNING = new Set();
  * Split out as a pure function so both branches can be tested from either platform.
  */
 export function killTreePlan(pid, signal, platform = process.platform) {
+  if (!isKillablePid(pid, platform)) return null;
   return platform === 'win32' ? { args: ['/PID', String(pid), '/T', '/F'], command: 'taskkill' } : { signal };
 }
 
-// Best-effort kill of a child's whole process tree (sh → pnpm → vitest →
-// fork workers). Killing only the direct child orphans the tree — exactly the
-// zombie workers a deadlock leaves behind. Children are collected via pgrep
-// and killed leaves-first.
-function killTree(child, signal = 'SIGTERM') {
-  const plan = killTreePlan(child.pid, signal);
+/**
+ * Kill `pid` and its whole process tree, with every effect injected.
+ *
+ * Injecting the platform alone is not enough: the effects would still run for real, against
+ * this machine, with whatever pid the test chose. So all four are required and nothing
+ * defaults — a test cannot reach a real `taskkill`, `pgrep` or `process.kill` by leaving one
+ * out. `killTree` below is the only caller that passes the real ones.
+ *
+ * - `run(command, args)` executes the Windows plan.
+ * - `childrenOf(pid)` returns the direct children of `pid` (POSIX).
+ * - `signal(pid, sig)` delivers `sig` to `pid` (POSIX).
+ *
+ * POSIX order is leaves first, so a parent cannot respawn a child that was just killed, and
+ * each pid is signalled at most once. Pids a lookup returns pass the same check as the root —
+ * a stray 1 in `pgrep` output must not become a signal to init.
+ */
+export function killTreeWith(pid, sig, { childrenOf, platform, run, signal }) {
+  for (const [name, fn] of Object.entries({ childrenOf, run, signal })) {
+    if (typeof fn !== 'function') throw new TypeError(`killTreeWith: \`${name}\` must be injected`);
+  }
+  if (typeof platform !== 'string') throw new TypeError('killTreeWith: `platform` must be injected');
+  const plan = killTreePlan(pid, sig, platform);
+  if (!plan) return;
   if (plan.command) {
     try {
-      execFileSync(plan.command, plan.args, { stdio: 'ignore' });
+      run(plan.command, plan.args);
     } catch {
       /* already gone, or taskkill refused — nothing further to try */
     }
     return;
   }
-  const pids = [];
-  const collect = (pid) => {
-    pids.push(pid);
-    let out = '';
+  const seen = new Set();
+  const order = [];
+  const collect = (p) => {
+    if (seen.has(p) || !isKillablePid(p, platform)) return;
+    seen.add(p);
+    let children = [];
     try {
-      out = execSync(`pgrep -P ${pid}`, { stdio: ['ignore', 'pipe', 'ignore'] })
-        .toString()
-        .trim();
+      children = childrenOf(p);
     } catch {
       /* no children */
     }
-    if (out) for (const p of out.split('\n')) collect(Number(p));
+    for (const c of children) collect(c);
+    order.push(p);
   };
-  collect(child.pid);
-  for (const pid of pids.reverse()) {
+  collect(pid);
+  for (const p of order) {
     try {
-      process.kill(pid, signal);
+      signal(p, plan.signal);
     } catch {
       /* already gone */
     }
   }
 }
 
+/** Direct children of `pid` via `pgrep -P`; empty when there are none (pgrep exits 1). */
+function pgrepChildren(pid) {
+  const out = execFileSync('pgrep', ['-P', String(pid)], { stdio: ['ignore', 'pipe', 'ignore'] })
+    .toString()
+    .trim();
+  return out ? out.split('\n').map(Number) : [];
+}
+
+// Best-effort kill of a child's whole process tree (sh → pnpm → vitest →
+// fork workers). Killing only the direct child orphans the tree — exactly the
+// zombie workers a deadlock leaves behind.
+function killTree(child, signal = 'SIGTERM') {
+  killTreeWith(child.pid, signal, {
+    childrenOf: pgrepChildren,
+    platform: process.platform,
+    run: (command, args) => execFileSync(command, args, { stdio: 'ignore' }),
+    signal: (pid, sig) => process.kill(pid, sig),
+  });
+}
+
 // idleTimeoutMs > 0 arms the no-output watchdog for this child; 0 (the default)
 // runs it unwatched. Only callers that KNOW the child streams progress (test
 // steps) should pass a timeout — see runGroup.

package/build/templates/check/lt-monorepo-pin.json

@@ -1,13 +1,13 @@
 {
-  "commit": "fcf7c83cffa37b09db88481833e7ccc0dd2fbe0f",
+  "commit": "26365f7c8acaa98bc48f360886055d0fe45c593d",
   "files": {
     "build-test-gate.mjs": "865bf1b9dd28151f53b9f2dfe4c3c46d29b9303fb1c2f497ce0e3136bcd37d71",
-    "check.mjs": "fed669a625b56d907ab2e3693c2e5797a877c460588bd79f89249d88c568c178",
+    "check.mjs": "6be5506f5fb63f53c65ea438c67d810de1afe1f3299828ef4531c37cc2457d4b",
     "lib/ansi.mjs": "f997ee6e9bf1c7ee54ab612d4040fcc778064ec160eae19bf5c3960a75a6e2ff",
     "lib/audit-report.mjs": "503825c3342dec1ee5d8d70e5af21b73e798faee320426b2492190cde0801df2",
     "lib/workspace-packages.mjs": "ccdd133622a88186c924bc8271d35cf1f8357dc26d4a607998ca5e91fce5bf88"
   },
-  "ref": "v3.13.1",
+  "ref": "v3.14.1",
   "repository": "lenneTech/lt-monorepo",
-  "version": "3.13.1"
+  "version": "3.14.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.50.0",
+  "version": "1.50.2",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -41,7 +41,7 @@
     "lint:fix": "eslint \"./src/**/*.{ts,js,vue}\" --fix",
     "prepublishOnly": "npm run build",
     "preversion": "npm run lint",
-    "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm cache clean --force && npm i && npm run build",
+    "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm i && npm run build",
     "snapupdate": "jest --updateSnapshot",
     "start": "node bin/lt",
     "start:build": "npm run build && node bin/lt --compiled-build",
@@ -58,12 +58,13 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1100.0",
+    "@aws-sdk/client-s3": "3.1146.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
-    "axios": "1.19.0",
+    "axios": "1.20.0",
     "bcrypt": "6.0.0",
     "cross-spawn": "7.0.6",
-    "defuddle": "0.19.2",
+    "defuddle": "0.19.4",
+    "ejs": "6.0.1",
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "1.0.0",
@@ -71,8 +72,8 @@
     "jsdom": "29.1.1",
     "jsonc-parser": "3.3.1",
     "lodash": "4.18.1",
-    "open": "11.0.0",
-    "playwright-core": "1.62.1",
+    "open": "11.0.4",
+    "playwright-core": "1.63.0",
     "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
     "turndown": "7.2.4",
@@ -84,8 +85,8 @@
     "@emnapi/runtime": "Same as @emnapi/core."
   },
   "devDependencies": {
-    "@emnapi/core": "^1.11.3",
-    "@emnapi/runtime": "^1.11.3",
+    "@emnapi/core": "1.11.3",
+    "@emnapi/runtime": "1.11.3",
     "@lenne.tech/eslint-config-ts": "2.3.0",
     "@lenne.tech/npm-package-helper": "0.0.12",
     "@types/cross-spawn": "6.0.6",
@@ -93,33 +94,32 @@
     "@types/jest": "30.0.0",
     "@types/js-yaml": "4.0.9",
     "@types/jsdom": "28.0.1",
-    "@types/lodash": "4.17.24",
-    "@types/node": "26.1.2",
+    "@types/lodash": "4.17.25",
+    "@types/node": "26.6.4",
     "@types/turndown": "5.0.6",
-    "ejs": "6.0.1",
-    "eslint": "10.8.0",
+    "eslint": "10.12.0",
     "husky": "9.1.7",
-    "jest": "30.4.2",
+    "jest": "30.5.2",
     "minimatch": "10.2.6",
-    "prettier": "3.8.3",
+    "prettier": "3.9.9",
     "rimraf": "6.1.3",
-    "ts-jest": "29.4.12"
+    "ts-jest": "29.4.14"
   },
   "//overrides": {
     "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
-    "brace-expansion@<1.1.18": "Two DoS advisories: exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high) and unbounded expansion length causing an OOM crash (GHSA-mh99-v99m-4gvg, high). Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude/ts-morph > minimatch. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
-    "brace-expansion@>=2.0.0 <2.1.4": "Same advisories, 2.x line.",
-    "brace-expansion@>=5.0.0 <5.0.9": "Same advisories, 5.x line. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors.",
-    "//minimatch-note": "brace-expansion 1.x and 2.x are END OF LINE for GHSA-mh99-v99m-4gvg: the advisory range is <=5.0.7 across ALL majors and upstream patched ONLY 5.0.8+. 1.1.18 and 2.1.4 are the newest releases of their majors and remain vulnerable. Forcing brace-expansion 5.x globally is NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. The only real fix is to raise each CONSUMER off minimatch 3.x/5.x, which is what the scoped entries below do. Each was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
-    "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. Covers filelist (gluegun > ejs > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1), @typescript-eslint/typescript-estree (^9.0.4) and jest-config/jest-runtime/@jest/reporters (^9). Verified safe per consumer: filelist calls only the static helper `minimatch.match(files, pat, opts)`; typescript-estree calls the named `minimatch(filePath, pattern, { dot: true })`; the three jest packages declare minimatch but never require it. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Drop once these consumers request minimatch >=10 themselves.",
-    "babel-plugin-istanbul > test-exclude@<8": "test-exclude 6.0.0 pins minimatch ^3.0.4 and glob ^7. test-exclude 8.0.0 uses minimatch ^10.2.2 + glob ^13 (the glob major this project already ships) and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul's _interopRequireDefault + `new TestExclude(opts)` keeps working. Drop once babel-plugin-istanbul widens its ^6.0.0 range.",
+    "brace-expansion@<1.1.21": "Five DoS advisories, all patched in the 1.x line by 1.1.21: exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high, fixed 1.1.16), unbounded expansion length causing an OOM crash (GHSA-mh99-v99m-4gvg, high, fixed 1.1.17), uncontrolled recursion in parseCommaParts (GHSA-6j4f-fj2g-mc7p, high, fixed 1.1.19), uncontrolled recursion on nested brace groups (GHSA-qhr7-859c-m2p7, high, fixed 1.1.20) and quadratic-time `{a},b}` rewrite (GHSA-q2hr-2g5m-vwhr, medium, fixed 1.1.21). Raised from 1.1.18 on 2026-10-03: 1.1.18 was still open to the last three. Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude/ts-morph > minimatch. Latent today: the minimatch raises below leave no 1.x install in the tree (only brace-expansion 5.0.12), so this key catches a future minimatch 3.x consumer. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
+    "brace-expansion@>=2.0.0 <2.1.7": "Same five advisories, 2.x line (fixed 2.1.2 / 2.1.3 / 2.1.5 / 2.1.6 / 2.1.7). Raised from 2.1.4 on 2026-10-03. Latent today, like the 1.x key.",
+    "brace-expansion@>=5.0.0 <5.0.12": "Same advisories, 5.x line, plus three newer DoS advisories fixed only in 5.0.10-5.0.12 (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr; all high). Reaches production via gluegun > fs-jetpack > minimatch. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors.",
+    "//minimatch-note": "Why the minimatch raises exist: when they were added, brace-expansion 1.x and 2.x were END OF LINE for GHSA-mh99-v99m-4gvg (advisory range <=5.0.7 across ALL majors, patched only 5.0.8+), so the only fix was to raise each CONSUMER off minimatch 3.x/5.x/9.x. That premise no longer holds: upstream has since backported every fix (GHSA-mh99 now reads <1.1.17 / >=2.0.0 <2.1.3, and 1.1.21 / 2.1.7 patch all five current advisories). Verified 2026-10-03 with fresh lockfile resolves: without `minimatch@>=4 <10` and `fs-jetpack > minimatch@<10` npm audit is still clean, the tree only gains minimatch 3.1.5 + 5.1.9 and brace-expansion 1.1.21 + 2.1.7 (7 packages). So both are now a DEDUPE measure (one minimatch 10.2.6, one brace-expansion 5.0.12), not a security fix - dropping them is a judgment call, it reopens no advisory. Forcing brace-expansion 5.x globally is still NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. Each scoped entry was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
+    "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. As of 2026-10-03 the only consumer it still raises is filelist (gluegun > ejs 3.1.10 > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1): @typescript-eslint/typescript-estree 8.65 requests ^10.2.2 itself and the jest 30.5 packages no longer depend on minimatch. Verified safe: filelist calls only the static helper `minimatch.match(files, pat, opts)`. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Dedupe, not security (see //minimatch-note). Drop once filelist requests minimatch >=10.",
+    "babel-plugin-istanbul > test-exclude@<8": "Dedupe override, no longer a security fix. Added when babel-plugin-istanbul requested test-exclude ^6.0.0, whose 6.0.0 pins minimatch ^3.0.4 and glob ^7. Since jest 30.5 (babel-plugin-istanbul 8.0.0) the request is ^7.0.1, and test-exclude 7.0.2 already uses minimatch ^10.2.2: a fresh resolve without this entry audits clean (2026-10-03) but adds 23 packages (glob 10.5.0 and its subtree). 8.0.0 uses glob ^13, the major this project already ships, and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul 8's _interopRequireDefault + `new _testExclude.default(opts)` keeps working. Drop once babel-plugin-istanbul requests test-exclude ^8.",
     "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched)."
   },
   "overrides": {
     "semver@*": "7.8.5",
-    "brace-expansion@<1.1.18": "1.1.18",
-    "brace-expansion@>=2.0.0 <2.1.4": "2.1.4",
-    "brace-expansion@>=5.0.0 <5.0.9": "5.0.9",
+    "brace-expansion@<1.1.21": "1.1.21",
+    "brace-expansion@>=2.0.0 <2.1.7": "2.1.7",
+    "brace-expansion@>=5.0.0 <5.0.12": "5.0.12",
     "fs-jetpack": {
       "minimatch@<10": "10.2.6"
     },