Prevent stack exhaustion in deeply nested braces patterns

[Copilot]

Summary

The transitive braces@3.0.3 parser allows deeply nested patterns that can exhaust the stack during recursive AST processing. This change caps nesting and AST traversal at 100 and rejects cyclic expansion parent chains.

• Mitigation: Patch braces through pnpm’s patched-dependency mechanism and update the lockfile.
• Coverage: Add regressions for deeply nested patterns, ASTs, and cyclic parent chains.

API compatibility

API_BREAKING_CHANGE_JUSTIFICATION:
API_BREAKING_CHANGE_MIGRATION_PLAN:

[Copilot]

🟢 Approved

The mitigation, lockfile metadata, and regression coverage are consistent and complete.

0 open findings

What changed in this PR

Adds a pnpm dependency patch that limits braces@3.0.3 recursion depth and rejects cyclic AST parent chains.

Changes:

• Caps parsing and AST traversal depth at 100.
• Updates pnpm patch metadata and lockfile references.
• Adds security regression tests to the unit suite.

File	Description
patches/​braces@3.0.3.patch	Implements parser and AST recursion safeguards.
pnpm-workspace.yaml	Registers the braces patch.
pnpm-lock.yaml	Records patch hash and patched snapshot.
scripts/​tests/​braces-security-patch.test.mjs	Tests normal use, excessive depth, and cycles.
package.json	Adds the regression tests to test:unit.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.