fix(deps): resolve brace-expansion DoS advisory; scope audit to production deps

.github/workflows/ci.yml

@@ -26,5 +26,8 @@ jobs:
       - name: Check
         run: npm run check
 
+      - name: Audit production dependencies
+        run: npm run audit
+
       - name: Verify package contents
         run: npm pack --dry-run

CLAUDE.md

@@ -13,6 +13,10 @@ manager or publisher.
   tests run the real built binary (`dist/cli.js`) via `bintastic`.
 - `npm run check` — the full gate (`test:all`): `format:check` → `lint` →
   `typecheck` → `test` → `build` → `docs`. Run this before considering work done.
+- `npm run audit` — `npm audit --omit=dev`, also run in CI. Scoped to production
+  dependencies on purpose: devDependencies (eslint, test fixtures, etc.) never
+  ship in the published package, so a vulnerability there isn't a risk to
+  consumers — don't add fixes/overrides for dev-only findings.
 - `npm run build` — bundle with tsup.
 - After changing CLI commands/options, regenerate the README CLI reference with
   `node dist/cli.js docs` (the gate's `docs --check` fails if it is stale).

package.json

@@ -47,6 +47,7 @@
     "README.md"
   ],
   "scripts": {
+    "audit": "npm audit --omit=dev",
     "build": "tsup",
     "check": "npm run test:all",
     "dev": "tsx src/cli.ts",
@@ -110,6 +111,7 @@
   "overrides": {
     "esbuild": "^0.28.1",
     "undici": "^7.28.0",
-    "tmp": "^0.2.7"
+    "tmp": "^0.2.7",
+    "brace-expansion": "^5.0.8"
   }
 }