Update bundled brace-expansion for GHSA-3jxr-9vmj-r5cp

Summary

The current pnpm/action-setup release bundles brace-expansion 1.1.12, which is covered by GHSA-3jxr-9vmj-r5cp, an exponential-time denial-of-service vulnerability.

Current release

The v6 branch and v6.0.9 release resolve brace-expansion 1.1.12 in pnpm-lock.yaml. The checked-in dist/index.js bundle also includes the vulnerable implementation.

The patched 1.x floor is 1.1.16. The advisory was published after v6.0.9, and I could not find an existing issue or pull request tracking it.

Requested remediation

Please update brace-expansion to at least 1.1.16, regenerate the lockfile, rebuild dist/index.js, and publish a patched release. Verifying the generated bundle is important because consumers pin and execute the committed JavaScript rather than installing the repository lockfile.

Exploitability depends on whether a workflow exposes brace patterns to untrusted input, but downstream repositories and security scanners still inherit the bundled vulnerable code.

Start with pnpm-lock.yaml on the v6 branch and inspect the committed dist/index.js bundle to trace the bundled brace-expansion version. Update the dependency, regenerate the lockfile, rebuild the bundle, and verify that the vulnerable implementation is gone. Done means the patched bundle is committed and a patched release is published.