Distillation

Date: Jul 28, 2026

• 🟡 (12:32) Agent confirmed minimatch@10.2.5 source line 155 calls brace_expansion_1.expand as a named export: return (0, brace_expansion_1.expand)(pattern, ...)
• 🟡 (12:32) Agent confirmed brace-expansion@5.0.7 (and 5.0.8) uses ./dist/commonjs/index.js with exports.expand = expand (named export). CVE-2026-14257 fix added EXPANSION_MAX_LENGTH constant (100k character bound on accumulator) to prevent memory exhaustion from chained {a,b} expansions. 5.0.7 is patched; 5.0.8 is latest per #323
• 🟡 (12:32) Agent conclusion: PR #1341 re-introduces exact bug fixed by PR #1337 — minimatch@10.2.5 paired with brace-expansion@2.1.3 (override only covers v2.x), will throw TypeError: (0, brace_expansion_1.expand) is not a function during macOS DMG/zip build
• 🟡 (12:33) Agent confirmed @xmldom/xmldom@0.9.10 DOMParser.prototype.parseFromString (line 220-222) strictly validates mimeType: if (!isValidMimeType(mimeType)) throw new TypeError('...') — no more undefined fallback. 0.8.13 had fallback behavior
• 🟡 (12:33) Agent confirmed plist@3.1.0 index.js line 9: const { DOMParser } = require('@xmldom/xmldom'); — uses destructured named import (compatible with both 0.8.x and 0.9.x exports)
• 🟡 (12:33) Agent examining plist@3.1.0/3.1.1 source to find actual DOMParser.parseFromString call site and whether it passes a mimeType (live investigation in progress)
• 🟡 (12:33) Plist npm registry latest tag shows: latest: 5.0.0 — plist 5.x exists as a major version separate from the 3.1.x line in PR #1341/#1342 lockfile