office-addin-lint fails with "TypeError: expand is not a function" when repository uses brace-expansion resolution override

[ArunaEdirisinghe1]

Prerequisites

• I am running the latest version of Node and the tools
• I checked the documentation and found no answer
• I checked to make sure that this issue has not already been filed

Expected behavior

office-addin-lint should run successfully (or fail with normal lint violations) when project dependencies are pinned for security remediation via Yarn resolutions.

Specifically, adding a brace-expansion override to address vulnerabilities should not cause runtime crashes in lint commands.

Current behavior

When a brace-expansion override is added in package.json resolutions, office-addin-lint crashes during lint:fix with:

TypeError: expand is not a function

This blocks local lint and pre-commit flows.

Steps to Reproduce

1. In a project using office-addin-lint, add this to package.json:

   {
     "resolutions": {
       "brace-expansion": "^5.0.8"
     }
   }
   

2. Run

       yarn install
       yarn lint:fix

3. Observe runtime error from minimatch / brace-expansion: TypeError: expand is not a function

Context

Operating System: Linux
Tool version:
office-addin-lint: ^2.2.3 (also observed while testing newer ^3.0.10)
Yarn: 1.22.x

Failure Logs

$ node_modules/.bin/office-addin-lint fix --files integrations///*.{ts,tsx,js,jsx}

Oops! Something went wrong! :(

ESLint: 9.39.5

TypeError: expand is not a function
at Minimatch.braceExpand (.../node_modules/minimatch/minimatch.js:271:10)
at Minimatch.make (.../node_modules/minimatch/minimatch.js:180:33)
at new Minimatch (.../node_modules/minimatch/minimatch.js:156:8)
at .../node_modules/office-addin-lint/node_modules/eslint/lib/eslint/eslint-helpers.js:288:10
at Array.map ()
at globSearch (.../eslint-helpers.js:283:28)
at .../eslint-helpers.js:457:4
at Array.map ()
at globMultiSearch (.../eslint-helpers.js:456:22)
at findFiles (.../eslint-helpers.js:629:3)

error Command failed with exit code 2.

[millerds]

What is the justification for the expectation? If a package was build using a particular dependency, overriding that (for whatever reason) doesn't mean it's going to automatically work . . . especially in the down-level dependency case. Changes in that dependency could easily cause something to break . . . and this is one of those cases.

In this particular case, brace-expansion is a down-level dependency with intermediate packages need to get updated to support newer versions of brace-expansion before office-addin-lint can. Specifically, office-addin-lint -> eslint-plugin-office-addins -> eslint-plugin-react -> minimatch -> brace-expansion.

We recognize there are vulnerabilities (many these days), including this one, and are continually looking at them and making updates as fixes become available. This case will be fixed once the down-level packages provide a fix.