fix: bump brace-expansion and nx to clear ReDoS advisory

[prajwalu142]

Problem

osv-scanner flagged brace-expansion@1.1.16 and @2.1.2 (GHSA-mh99-v99m-4gvg, CVSS 7.5 ReDoS) as blocking, failing the release gate (>= CVSS 7.0). The upstream fix only ships in brace-expansion@5.0.8, which changed its export shape in a way that broke nx's bundled minimatch usage.

Goal

Resolve to the patched brace-expansion release with a clean build, no compatibility shims.

Fix

• Pin brace-expansion to 5.0.8 via root resolutions/overrides.
• Bump nx (lerna's project-graph dependency) to 22.7.7, whose own minimatch dependency already speaks brace-expansion's new export API.

Note: lerna's own nested minimatch@3.0.5 still calls brace-expansion in the old callable style, which is technically mismatched with 5.0.8. It isn't triggered in practice because this repo's lerna/nx config never uses brace-syntax ({a,b}) glob patterns.

Testing

Ran a full clean yarn install (postinstall + lerna run build --stream across all 112 packages succeeds) and re-ran osv-scanner locally with the same config CI uses -- brace-expansion no longer appears in the results and no advisory group is at or above CVSS 7.0.

[diksha190]

Approved.

Exception type: CVE fix — GHSA-mh99-v99m-4gvg / CVE-2026-14257 (brace-expansion DoS via unbounded expansion, CVSS 7.5 High). Qualifies under the Dependency Exception Policy (severity ≥ 7.0).

Review:

• Fixed version confirmed: brace-expansion@5.0.8 (published ~4-5 days ago, hence the cooldown block)
• Socket: Deep score 81 (≥70 threshold), no high/critical alerts
• Aikido SafeChain: npm install brace-expansion@5.0.8 completed without being blocked
• Package: brace-expansion@5.0.8. No conditions.