fix(security): bump braces to 3.0.3 — ReDoS (SDK-6068)

[AakashHotchandani]

Summary

Remediates SDK-6068 — braces ReDoS (GHSA-grv7-fg5c-xmjg, CWE-400, CVSS 6.5).

braces@3.0.2 (< 3.0.3) is vulnerable to uncontrolled resource consumption: a malformed brace expression triggers catastrophic backtracking that hangs the process. It's reachable transitively here (nightwatch → chokidar → braces) and is used during nightwatch test-path glob expansion. In CI, if an attacker can influence the test path (chains with the commit_sha vector), the runner can be hung — pipeline DoS.

Change (lockfile-only, surgical)

The lockfile is lockfileVersion: 1; rather than migrate the whole file to v3, this is a targeted 2-entry edit:

• braces 3.0.2 → 3.0.3 (its requires floor moves to fill-range ^7.1.1)
• fill-range 7.0.1 → 7.1.1 (braces 3.0.3's pinned dependency; to-regex-range ^5.0.1 dep unchanged; braces is its only consumer)

Patch-level bump, non-breaking, no package.json change needed.

Verification

• npm ci against the edited lockfile succeeds (proves the lockfile is internally consistent).
• npm ls braces resolves braces@3.0.3 / fill-range@7.1.1 — vulnerable braces@3.0.2 is gone.
• Diff: package-lock.json only, 7 ins / 7 del.

Jira: SDK-6068

🤖 Generated with Claude Code

[AakashHotchandani]

🤖 Automated review (pr-review agent)

Verdict: ✅ Approve — Risk: Low · 0 critical · 0 warnings · 2 informational follow-ups.

Surgical lockfileVersion-1 edit verified correct and internally consistent:

• Integrity hashes & resolved URLs for braces@3.0.3 and fill-range@7.1.1 match the npm registry byte-for-byte.
• braces's requires floor correctly raised to fill-range ^7.1.1; fill-range's to-regex-range ^5.0.1 left unchanged.
• Transitive tree stays consistent — chokidar's ~3.0.2 admits 3.0.3, braces is fill-range's only consumer, no stale pins elsewhere. The 2-entry edit is complete.
• Keeping lockfileVersion 1 (vs migrating to v3) is the right minimal call for a CVE patch.
• Vulnerable braces@3.0.2 is gone (npm ci resolves 3.0.3).

Per-file confidence: package-lock.json → 🟢 All Clear (objectively verified against npm registry).

Informational follow-ups (not blockers): a deliberate v1→v3 lockfile migration on a separate PR; enable Dependabot (now added in #83) to automate future transitive bumps.