Update bundled brace-expansion for GHSA-3jxr-9vmj-r5cp #1596

Summary

The current actions/setup-node release bundles brace-expansion versions covered by GHSA-3jxr-9vmj-r5cp, an exponential-time denial-of-service vulnerability.

Current release

v7.0.0 resolves vulnerable versions in its lockfile (entry, 1.x entry, 2.x entry):

• brace-expansion 1.1.13
• brace-expansion 2.1.1
• brace-expansion 5.0.6

The checked-in dist/setup bundle also includes the brace-expansion implementation. The advisory's patched floors are:

• 1.x: 1.1.16
• 2.x: 2.1.2
• 5.x: 5.0.7

The advisory was published after v7.0.0. I could not find an existing issue or pull request tracking it.

Requested remediation

Please update the affected dependency lines, regenerate the lockfile, rebuild all checked-in dist artifacts, and publish a patched release. Verifying the generated bundle is important because consumers pin and execute the committed JavaScript rather than installing the repository lockfile.

Exploitability depends on whether a workflow exposes brace patterns to untrusted input, but downstream repositories and security scanners still inherit the bundled vulnerable code.