Distillation

Date: July 28, 2026

• 🟡 (11:11) User pasted grep results of node_modules for "brace-expansion" string matches. Minimatch versions present in tree: 9.0.9 (dist/esm + dist/commonjs), 8.0.7 (dist/cjs + dist/mjs), 3.1.5 (minimatch.js), 5.1.9 (minimatch.js). Also braces@3.0.3 and is-arrayish@0.3.2 present (brace-expansion deps).
• 🟡 (11:11) User pasted grep of importers of brace-expansion — ALL use CJS require('brace-expansion') (no ESM default import): app-builder-lib@24.13.3 (minimatch.js:19 const expand = require('brace-expansion')), dir-compare@3.3.0 & @4.2.0 (minimatch.js:10 var expand = require('brace-expansion')), @electron/asar@3.2.13 & @3.4.1 (minimatch.js:10), @electron/universal@1.5.1 (minimatch.js:10), eslint@8.57.1 (minimatch.js:10), @eslint/eslintrc@2.1.4 (minimatch.js:10), filelist@1.0.4 (minimatch.js:19 const expand = require('brace-expansion')), glob@7.2.3 (minimatch.js:10).
• 🟡 (11:11) Assistant confirmed all importers call expand.expand(...) and never access .default, so CJS require returning module.exports works. Root-cause refinement: Vite module-runner evaluates Astro config in ESM context; an ESM module doing import brace from 'brace-expansion' (default import of CJS) fails when CJS has __esModule: true and no default (5.0.8). 5.0.7 (no __esModule) gets synthesized default = module.exports → works.
• 🟡 (11:11) Assistant decision STATE CHANGE from 11:08 plan (keep 2.x patched + leave 5.x at 5.0.7 + document #323 residual). 3 alternatives now evaluated: (1) Force 5.x→5.0.8 — REJECTED (breaks Vite/Astro build, no CJS default export); (2) Leave 5.x at 5.0.7 + document residual — initially favored but leaves Dependabot #323 open (advisory range <=5.0.7 covers both 2.1.0 and 5.0.7); (3) Override glob@13.0.6→glob@10.4.5 (minimatch 9 → brace 2.x CJS) — initially REJECTED as risky (glob@13 vs 10 API), now chosen to TEST via pnpm override "glob@>=13.0.0": "10.4.5" + rebuild website, as only way to clear #323 fully while keeping build green.
• 🟡 (11:11) User stated importers all use require('brace-expansion') CJS (5.0.7 works, 5.0.8 fails via __esModule); stated @vercel/nft hard-pins glob@^13→minimatch 10→brace 5.x; stated plan to test overriding glob@13 to glob@10.4.5 (uses minimatch 9 → brace 2.x CJS) to avoid the 5.x line and clear #323 without breaking build.