pnpm 10.33.0 → 10.33.2

package/dist/node_modules/.modules.yaml

@@ -16,17 +16,17 @@
     "node-gyp@11.5.0": [
       "node_modules/node-gyp"
     ],
-    "tar@7.5.12": [
+    "nopt@8.1.0": [
+      "node_modules/nopt"
+    ],
+    "tar@7.5.13": [
       "node_modules/tar"
     ],
     "proc-log@5.0.0": [
       "node_modules/proc-log"
     ],
-    "which@5.0.0": [
-      "node_modules/which"
-    ],
-    "graceful-fs@4.2.11": [
-      "node_modules/graceful-fs"
+    "tinyglobby@0.2.16": [
+      "node_modules/tinyglobby"
     ],
     "exponential-backoff@3.1.3": [
       "node_modules/exponential-backoff"
@@ -34,44 +34,53 @@
     "env-paths@2.2.1": [
       "node_modules/env-paths"
     ],
+    "which@5.0.0": [
+      "node_modules/which"
+    ],
+    "graceful-fs@4.2.11": [
+      "node_modules/graceful-fs"
+    ],
     "semver@7.7.4": [
       "node_modules/semver"
     ],
-    "nopt@8.1.0": [
-      "node_modules/nopt"
-    ],
     "make-fetch-happen@14.0.3": [
       "node_modules/make-fetch-happen"
     ],
-    "tinyglobby@0.2.15": [
-      "node_modules/tinyglobby"
+    "abbrev@3.0.1": [
+      "node_modules/abbrev"
     ],
     "yallist@5.0.0": [
       "node_modules/yallist"
     ],
+    "chownr@3.0.0": [
+      "node_modules/chownr"
+    ],
+    "@isaacs/fs-minipass@4.0.1": [
+      "node_modules/@isaacs/fs-minipass"
+    ],
     "minizlib@3.1.0": [
       "node_modules/minizlib"
     ],
     "minipass@7.1.3": [
       "node_modules/minipass"
     ],
-    "@isaacs/fs-minipass@4.0.1": [
-      "node_modules/@isaacs/fs-minipass"
+    "picomatch@4.0.4": [
+      "node_modules/picomatch"
     ],
-    "chownr@3.0.0": [
-      "node_modules/chownr"
+    "fdir@6.5.0(picomatch@4.0.4)": [
+      "node_modules/fdir"
     ],
     "isexe@3.1.1": [
       "node_modules/isexe"
     ],
-    "abbrev@3.0.1": [
-      "node_modules/abbrev"
+    "ssri@12.0.0": [
+      "node_modules/ssri"
     ],
     "negotiator@1.0.0": [
       "node_modules/negotiator"
     ],
-    "ssri@12.0.0": [
-      "node_modules/ssri"
+    "cacache@19.0.1": [
+      "node_modules/cacache"
     ],
     "minipass@3.3.6": [
       "node_modules/minipass-flush/node_modules/minipass",
@@ -83,50 +92,38 @@
       "node_modules/minipass-pipeline/node_modules/yallist",
       "node_modules/minipass-sized/node_modules/yallist"
     ],
-    "cacache@19.0.1": [
-      "node_modules/cacache"
-    ],
-    "minipass-fetch@4.0.1": [
-      "node_modules/minipass-fetch"
+    "http-cache-semantics@4.2.0": [
+      "node_modules/http-cache-semantics"
     ],
     "promise-retry@2.0.1": [
       "node_modules/promise-retry"
     ],
+    "minipass-fetch@4.0.1": [
+      "node_modules/minipass-fetch"
+    ],
     "@npmcli/agent@3.0.0": [
       "node_modules/@npmcli/agent"
     ],
-    "http-cache-semantics@4.2.0": [
-      "node_modules/http-cache-semantics"
-    ],
-    "picomatch@4.0.3": [
-      "node_modules/picomatch"
-    ],
-    "fdir@6.5.0(picomatch@4.0.3)": [
-      "node_modules/fdir"
+    "unique-filename@4.0.0": [
+      "node_modules/unique-filename"
     ],
     "minipass-collect@2.0.1": [
       "node_modules/minipass-collect"
     ],
-    "p-map@7.0.4": [
-      "node_modules/p-map"
-    ],
-    "unique-filename@4.0.0": [
-      "node_modules/unique-filename"
-    ],
     "fs-minipass@3.0.3": [
       "node_modules/fs-minipass"
     ],
-    "lru-cache@10.4.3": [
-      "node_modules/lru-cache"
-    ],
-    "glob@10.5.0": [
-      "node_modules/glob"
+    "p-map@7.0.4": [
+      "node_modules/p-map"
     ],
     "@npmcli/fs@4.0.0": [
       "node_modules/@npmcli/fs"
     ],
-    "encoding@0.1.13": [
-      "node_modules/encoding"
+    "glob@10.5.0": [
+      "node_modules/glob"
+    ],
+    "lru-cache@10.4.3": [
+      "node_modules/lru-cache"
     ],
     "retry@0.12.0": [
       "node_modules/retry"
@@ -134,8 +131,8 @@
     "err-code@2.0.3": [
       "node_modules/err-code"
     ],
-    "agent-base@7.1.4": [
-      "node_modules/agent-base"
+    "encoding@0.1.13": [
+      "node_modules/encoding"
     ],
     "http-proxy-agent@7.0.2": [
       "node_modules/http-proxy-agent"
@@ -143,27 +140,30 @@
     "https-proxy-agent@7.0.6": [
       "node_modules/https-proxy-agent"
     ],
+    "agent-base@7.1.4": [
+      "node_modules/agent-base"
+    ],
     "socks-proxy-agent@8.0.5": [
       "node_modules/socks-proxy-agent"
     ],
     "unique-slug@5.0.0": [
       "node_modules/unique-slug"
     ],
-    "path-scurry@1.11.1": [
-      "node_modules/path-scurry"
+    "foreground-child@3.3.1": [
+      "node_modules/foreground-child"
     ],
     "package-json-from-dist@1.0.1": [
       "node_modules/package-json-from-dist"
     ],
-    "minimatch@9.0.9": [
-      "node_modules/minimatch"
-    ],
-    "foreground-child@3.3.1": [
-      "node_modules/foreground-child"
+    "path-scurry@1.11.1": [
+      "node_modules/path-scurry"
     ],
     "jackspeak@3.4.3": [
       "node_modules/jackspeak"
     ],
+    "minimatch@9.0.9": [
+      "node_modules/minimatch"
+    ],
     "iconv-lite@0.6.3": [
       "node_modules/iconv-lite"
     ],
@@ -176,24 +176,24 @@
     "imurmurhash@0.1.4": [
       "node_modules/imurmurhash"
     ],
-    "brace-expansion@2.0.2": [
-      "node_modules/brace-expansion"
-    ],
-    "signal-exit@4.1.0": [
-      "node_modules/signal-exit"
-    ],
     "which@2.0.2": [
       "node_modules/cross-spawn/node_modules/which"
     ],
     "isexe@2.0.0": [
       "node_modules/cross-spawn/node_modules/isexe"
     ],
+    "signal-exit@4.1.0": [
+      "node_modules/signal-exit"
+    ],
     "@isaacs/cliui@8.0.2": [
       "node_modules/@isaacs/cliui"
     ],
     "@pkgjs/parseargs@0.11.0": [
       "node_modules/@pkgjs/parseargs"
     ],
+    "brace-expansion@2.1.0": [
+      "node_modules/brace-expansion"
+    ],
     "safer-buffer@2.1.2": [
       "node_modules/safer-buffer"
     ],
@@ -206,15 +206,20 @@
     "ip-address@10.1.0": [
       "node_modules/ip-address"
     ],
-    "balanced-match@1.0.2": [
-      "node_modules/balanced-match"
-    ],
     "shebang-command@2.0.0": [
       "node_modules/shebang-command"
     ],
     "path-key@3.1.1": [
       "node_modules/path-key"
     ],
+    "strip-ansi@7.2.0": [
+      "node_modules/strip-ansi"
+    ],
+    "ansi-regex@5.0.1": [
+      "node_modules/strip-ansi-cjs/node_modules/ansi-regex",
+      "node_modules/wrap-ansi-cjs/node_modules/ansi-regex",
+      "node_modules/string-width-cjs/node_modules/ansi-regex"
+    ],
     "wrap-ansi@8.1.0": [
       "node_modules/wrap-ansi"
     ],
@@ -230,11 +235,6 @@
     "ansi-styles@4.3.0": [
       "node_modules/wrap-ansi-cjs/node_modules/ansi-styles"
     ],
-    "ansi-regex@5.0.1": [
-      "node_modules/wrap-ansi-cjs/node_modules/ansi-regex",
-      "node_modules/string-width-cjs/node_modules/ansi-regex",
-      "node_modules/strip-ansi-cjs/node_modules/ansi-regex"
-    ],
     "emoji-regex@8.0.0": [
       "node_modules/wrap-ansi-cjs/node_modules/emoji-regex",
       "node_modules/string-width-cjs/node_modules/emoji-regex"
@@ -242,12 +242,15 @@
     "string-width@5.1.2": [
       "node_modules/string-width"
     ],
-    "strip-ansi@7.2.0": [
-      "node_modules/strip-ansi"
+    "balanced-match@1.0.2": [
+      "node_modules/balanced-match"
     ],
     "shebang-regex@3.0.0": [
       "node_modules/shebang-regex"
     ],
+    "ansi-regex@6.2.2": [
+      "node_modules/ansi-regex"
+    ],
     "ansi-styles@6.2.3": [
       "node_modules/ansi-styles"
     ],
@@ -257,19 +260,16 @@
     "color-convert@2.0.1": [
       "node_modules/color-convert"
     ],
-    "emoji-regex@9.2.2": [
-      "node_modules/emoji-regex"
-    ],
     "eastasianwidth@0.2.0": [
       "node_modules/eastasianwidth"
     ],
-    "ansi-regex@6.2.2": [
-      "node_modules/ansi-regex"
+    "emoji-regex@9.2.2": [
+      "node_modules/emoji-regex"
     ],
     "color-name@1.1.4": [
       "node_modules/color-name"
     ],
-    "minipass-flush@1.0.5": [
+    "minipass-flush@1.0.7": [
       "node_modules/minipass-flush"
     ],
     "minipass-pipeline@1.2.4": [
@@ -286,10 +286,10 @@
     ]
   },
   "nodeLinker": "hoisted",
-  "packageManager": "pnpm@10.32.1",
+  "packageManager": "pnpm@10.33.1",
   "pendingBuilds": [],
   "publicHoistPattern": [],
-  "prunedAt": "Tue, 24 Mar 2026 16:40:49 GMT",
+  "prunedAt": "Thu, 23 Apr 2026 11:46:36 GMT",
   "registries": {
     "default": "https://registry.npmjs.org/",
     "@jsr": "https://npm.jsr.io/"

package/dist/node_modules/.pnpm/lock.yaml

@@ -6,6 +6,7 @@ settings:
 
 overrides:
   '@yarnpkg/fslib@2': '3'
+  ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0'
   body-parser@<1.20.3: ^1.20.3
   clipanion: 3.2.0-rc.6
   cookie@<0.7.0: '>=0.7.0'
@@ -14,6 +15,8 @@ overrides:
   express@<4.22.1: ^4.22.1
   follow-redirects@<=1.15.5: '>=1.15.6'
   glob-parent@<5.1.2: '>=5.1.2'
+  handlebars@>=4.0.0 <4.7.9: '>=4.7.9'
+  handlebars@>=4.0.0 <=4.7.8: '>=4.7.9'
   hosted-git-info@1: npm:@pnpm/hosted-git-info@1.0.0
   http-proxy-middleware@<2.0.7: ^2.0.7
   isexe@3: 3.1.1
@@ -23,11 +26,17 @@ overrides:
   json5@<2.2.2: ^2.2.3
   jsonwebtoken@<=8.5.1: '>=9.0.0'
   jws@<3.2.3: ^3.2.3
+  lodash@<=4.17.23: '>=4.18.0'
+  lodash@>=4.0.0 <=4.17.22: '>=4.17.23'
+  lodash@>=4.0.0 <=4.17.23: '>=4.18.0'
+  minimatch@<3.1.4: ^3.1.4
+  minimatch@>=9.0.0 <9.0.7: ^9.0.7
   nopt@5: npm:@pnpm/nopt@^0.2.1
   on-headers@<1.1.0: '>=1.1.0'
   path-to-regexp@<0.1.12: ^0.1.12
   path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0'
   path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0'
+  qs@<6.14.1: '>=6.14.1'
   request: npm:postman-request@2.88.1-postman.40
   semver@<7.5.2: ^7.7.4
   send@<0.19.0: ^0.19.0
@@ -100,8 +109,8 @@ packages:
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
 
-  brace-expansion@2.0.2:
-    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
+  brace-expansion@2.1.0:
+    resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==}
 
   cacache@19.0.1:
     resolution: {integrity: sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==}
@@ -234,8 +243,8 @@ packages:
     resolution: {integrity: sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
-  minipass-flush@1.0.5:
-    resolution: {integrity: sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==}
+  minipass-flush@1.0.7:
+    resolution: {integrity: sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==}
     engines: {node: '>= 8'}
 
   minipass-pipeline@1.2.4:
@@ -290,8 +299,8 @@ packages:
     resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
     engines: {node: '>=16 || 14 >=14.18'}
 
-  picomatch@4.0.3:
-    resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
   proc-log@5.0.0:
@@ -358,12 +367,12 @@ packages:
     resolution: {integrity: sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==}
     engines: {node: '>=12'}
 
-  tar@7.5.12:
-    resolution: {integrity: sha512-9TsuLcdhOn4XztcQqhNyq1KOwOOED/3k58JAvtULiYqbO8B/0IBAAIE1hj0Svmm58k27TmcigyDI0deMlgG3uw==}
+  tar@7.5.13:
+    resolution: {integrity: sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==}
     engines: {node: '>=18'}
 
-  tinyglobby@0.2.15:
-    resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
+  tinyglobby@0.2.16:
+    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
   unique-filename@4.0.0:
@@ -461,7 +470,7 @@ snapshots:
   balanced-match@1.0.2:
     optional: true
 
-  brace-expansion@2.0.2:
+  brace-expansion@2.1.0:
     dependencies:
       balanced-match: 1.0.2
     optional: true
@@ -474,11 +483,11 @@ snapshots:
       lru-cache: 10.4.3
       minipass: 7.1.3
       minipass-collect: 2.0.1
-      minipass-flush: 1.0.5
+      minipass-flush: 1.0.7
       minipass-pipeline: 1.2.4
       p-map: 7.0.4
       ssri: 12.0.0
-      tar: 7.5.12
+      tar: 7.5.13
       unique-filename: 4.0.0
     optional: true
 
@@ -528,9 +537,9 @@ snapshots:
   exponential-backoff@3.1.3:
     optional: true
 
-  fdir@6.5.0(picomatch@4.0.3):
+  fdir@6.5.0(picomatch@4.0.4):
     optionalDependencies:
-      picomatch: 4.0.3
+      picomatch: 4.0.4
     optional: true
 
   foreground-child@3.3.1:
@@ -613,7 +622,7 @@ snapshots:
       http-cache-semantics: 4.2.0
       minipass: 7.1.3
       minipass-fetch: 4.0.1
-      minipass-flush: 1.0.5
+      minipass-flush: 1.0.7
       minipass-pipeline: 1.2.4
       negotiator: 1.0.0
       proc-log: 5.0.0
@@ -625,7 +634,7 @@ snapshots:
 
   minimatch@9.0.9:
     dependencies:
-      brace-expansion: 2.0.2
+      brace-expansion: 2.1.0
     optional: true
 
   minipass-collect@2.0.1:
@@ -642,7 +651,7 @@ snapshots:
       encoding: 0.1.13
     optional: true
 
-  minipass-flush@1.0.5:
+  minipass-flush@1.0.7:
     dependencies:
       minipass: 3.3.6
     optional: true
@@ -685,8 +694,8 @@ snapshots:
       nopt: 8.1.0
       proc-log: 5.0.0
       semver: 7.7.4
-      tar: 7.5.12
-      tinyglobby: 0.2.15
+      tar: 7.5.13
+      tinyglobby: 0.2.16
       which: 5.0.0
     transitivePeerDependencies:
       - supports-color
@@ -712,7 +721,7 @@ snapshots:
       minipass: 7.1.3
     optional: true
 
-  picomatch@4.0.3:
+  picomatch@4.0.4:
     optional: true
 
   proc-log@5.0.0:
@@ -791,7 +800,7 @@ snapshots:
       ansi-regex: 6.2.2
     optional: true
 
-  tar@7.5.12:
+  tar@7.5.13:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
       chownr: 3.0.0
@@ -800,10 +809,10 @@ snapshots:
       yallist: 5.0.0
     optional: true
 
-  tinyglobby@0.2.15:
+  tinyglobby@0.2.16:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
     optional: true
 
   unique-filename@4.0.0:

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,5 +1,5 @@
 {
-  "lastValidatedTimestamp": 1774370449201,
+  "lastValidatedTimestamp": 1776944796156,
   "projects": {},
   "pnpmfiles": [],
   "settings": {
@@ -7,6 +7,7 @@
     "dedupeDirectDeps": false,
     "dedupeInjectedDeps": true,
     "dedupePeerDependents": true,
+    "dedupePeers": false,
     "dev": true,
     "excludeLinksFromLockfile": false,
     "hoistPattern": [
@@ -19,6 +20,7 @@
     "optional": true,
     "overrides": {
       "@yarnpkg/fslib@2": "3",
+      "ajv@>=7.0.0-alpha.0 <8.18.0": ">=8.18.0",
       "body-parser@<1.20.3": "^1.20.3",
       "clipanion": "3.2.0-rc.6",
       "cookie@<0.7.0": ">=0.7.0",
@@ -27,6 +29,8 @@
       "express@<4.22.1": "^4.22.1",
       "follow-redirects@<=1.15.5": ">=1.15.6",
       "glob-parent@<5.1.2": ">=5.1.2",
+      "handlebars@>=4.0.0 <4.7.9": ">=4.7.9",
+      "handlebars@>=4.0.0 <=4.7.8": ">=4.7.9",
       "hosted-git-info@1": "npm:@pnpm/hosted-git-info@1.0.0",
       "http-proxy-middleware@<2.0.7": "^2.0.7",
       "isexe@3": "3.1.1",
@@ -36,11 +40,17 @@
       "json5@<2.2.2": "^2.2.3",
       "jsonwebtoken@<=8.5.1": ">=9.0.0",
       "jws@<3.2.3": "^3.2.3",
+      "lodash@<=4.17.23": ">=4.18.0",
+      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
+      "lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
+      "minimatch@<3.1.4": "^3.1.4",
+      "minimatch@>=9.0.0 <9.0.7": "^9.0.7",
       "nopt@5": "npm:@pnpm/nopt@^0.2.1",
       "on-headers@<1.1.0": ">=1.1.0",
       "path-to-regexp@<0.1.12": "^0.1.12",
       "path-to-regexp@>=4.0.0 <6.3.0": ">=6.3.0",
       "path-to-regexp@>=7.0.0 <8.0.0": ">=8.0.0",
+      "qs@<6.14.1": ">=6.14.1",
       "request": "npm:postman-request@2.88.1-postman.40",
       "semver@<7.5.2": "^7.7.4",
       "send@<0.19.0": "^0.19.0",

package/dist/node_modules/brace-expansion/index.js

@@ -61,10 +61,13 @@ function parseCommaParts(str) {
   return parts;
 }
 
-function expandTop(str) {
+function expandTop(str, options) {
   if (!str)
     return [];
 
+  options = options || {};
+  var max = options.max == null ? Infinity : options.max;
+
   // I don't know why Bash 4.3 does this, but it does.
   // Anything starting with {} will have the first two bytes preserved
   // but *only* at the top level, so {},a}b will not expand to anything,
@@ -75,7 +78,7 @@ function expandTop(str) {
     str = '\\{\\}' + str.substr(2);
   }
 
-  return expand(escapeBraces(str), true).map(unescapeBraces);
+  return expand(escapeBraces(str), max, true).map(unescapeBraces);
 }
 
 function embrace(str) {
@@ -92,7 +95,7 @@ function gte(i, y) {
   return i >= y;
 }
 
-function expand(str, isTop) {
+function expand(str, max, isTop) {
   var expansions = [];
 
   var m = balanced('{', '}', str);
@@ -101,11 +104,11 @@ function expand(str, isTop) {
   // no need to expand pre, since it is guaranteed to be free of brace-sets
   var pre = m.pre;
   var post = m.post.length
-    ? expand(m.post, false)
+    ? expand(m.post, max, false)
     : [''];
 
   if (/\$$/.test(m.pre)) {    
-    for (var k = 0; k < post.length; k++) {
+    for (var k = 0; k < post.length && k < max; k++) {
       var expansion = pre+ '{' + m.body + '}' + post[k];
       expansions.push(expansion);
     }
@@ -118,7 +121,7 @@ function expand(str, isTop) {
       // {a},b}
       if (m.post.match(/,(?!,).*\}/)) {
         str = m.pre + '{' + m.body + escClose + m.post;
-        return expand(str);
+        return expand(str, max, true);
       }
       return [str];
     }
@@ -130,7 +133,7 @@ function expand(str, isTop) {
       n = parseCommaParts(m.body);
       if (n.length === 1) {
         // x{{a,b}}y ==> x{a}y x{b}y
-        n = expand(n[0], false).map(embrace);
+        n = expand(n[0], max, false).map(embrace);
         if (n.length === 1) {
           return post.map(function(p) {
             return m.pre + n[0] + p;
@@ -148,7 +151,7 @@ function expand(str, isTop) {
       var y = numeric(n[1]);
       var width = Math.max(n[0].length, n[1].length)
       var incr = n.length == 3
-        ? Math.abs(numeric(n[2]))
+        ? Math.max(Math.abs(numeric(n[2])), 1)
         : 1;
       var test = lte;
       var reverse = y < x;
@@ -185,12 +188,12 @@ function expand(str, isTop) {
       N = [];
 
       for (var j = 0; j < n.length; j++) {
-        N.push.apply(N, expand(n[j], false));
+        N.push.apply(N, expand(n[j], max, false));
       }
     }
 
     for (var j = 0; j < N.length; j++) {
-      for (var k = 0; k < post.length; k++) {
+      for (var k = 0; k < post.length && expansions.length < max; k++) {
         var expansion = pre + N[j] + post[k];
         if (!isTop || isSequence || expansion)
           expansions.push(expansion);
@@ -200,4 +203,3 @@ function expand(str, isTop) {
 
   return expansions;
 }
-

package/dist/node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "repository": {
     "type": "git",
     "url": "git://github.com/juliangruber/brace-expansion.git"

package/dist/node_modules/minipass-flush/package.json

@@ -1,9 +1,12 @@
 {
   "name": "minipass-flush",
-  "version": "1.0.5",
+  "version": "1.0.7",
+  "publishConfig": {
+    "tag": "v1-legacy"
+  },
   "description": "A Minipass stream that calls a flush function before emitting 'end'",
   "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
-  "license": "ISC",
+  "license": "BlueOak-1.0.0",
   "scripts": {
     "test": "tap",
     "snap": "tap",
@@ -15,7 +18,7 @@
     "check-coverage": true
   },
   "devDependencies": {
-    "tap": "^14.6.9"
+    "tap": "^15.1.6"
   },
   "dependencies": {
     "minipass": "^3.0.0"