Minor: I believe the dependencies are in alphabetical order, so it would be good if this addition maintained that order.

We don't depend on brace-expansion ourselves, right? Perhaps best to try to update the dependency that pulls in the outdated library version.

unfortunately, that dependency comes from https://www.npmjs.com/package/@actions/glob, which is stuck at 0.5.0 from a year ago

Let's ask the actions folk to update their dependencies.

looking better, that dependency points to brace-expansion < 2.0.0, which is not problematic. The only problematic ones are 2.0.0 (that we don't have) and 2.0.1. I tried retracing where that comes from, but in the end just resorted to an explicit override of that specific version

Note that we're still pulling in v1.1.12 here — if we want to override this I think we need to modify the overrides property in package.json.

Either that or update all the dependencies that rely on old versions of brace-expansion

Right, if we can update minimatch, that's better. We've had situations before where we've wanted to bump a transient dependency before the direct dependency had bumped it.

Aha, now I see why dependabot didn't manage to do this update. I'll get back to it on Monday.

(notice I didn't tell which Monday 😜 😅 on it now)