build(deps): bump brace-expansion, @modelcontextprotocol/inspector and nodemon

[dependabot]

Bumps brace-expansion to 5.0.8 and updates ancestor dependencies brace-expansion, @modelcontextprotocol/inspector and nodemon. These dependencies need to be updated together.

Updates brace-expansion from 1.1.12 to 5.0.8

Release notes

Sourced from brace-expansion's releases.

v4.0.1

• fmt 5a5cc17
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

---

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

• feat: use string replaces instead of splits (#64) 278132b
• fmt dd72a59
• add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

• pkg: publish on tag 3.x 3059c07
• fmt 8229e6f
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

---

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

• Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8
• added jsdoc (#55) 68c0e37
• node 16 is EOL 9e781e9
• add standard 3494c4d
• use const and let (#57) dd5a4cb
• docs 6dad209
• remove test e3dd8ae
• ci: update node versions d23ede9
• docs: add @​lanodan to contributors 1eb3fa4
• docs 1e7c9cd
• switch from tape to test module (#60) 2520537
• Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1
• Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf
• docs: add back ci badge 8ee5626
• Add github actions, remove travis. Closes #52 (#53) 5c8756a
• CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

... (truncated)

Commits

• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• 5bf809e Remove Node.js 18 support (#110)
• 8cb5716 Bump markdown-it from 14.1.0 to 14.2.0 (#113)
• 43122df Bump sigstore from 4.1.0 to 4.1.1 (#119)
• 69bd65a Bump @​sigstore/verify from 3.1.0 to 3.1.1 (#118)
• b3bfbf0 Bump @​sigstore/core from 3.1.0 to 3.2.1 (#117)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @modelcontextprotocol/inspector from 0.17.2 to 2.0.0

Release notes

Sourced from @​modelcontextprotocol/inspector's releases.

2.0.0

The v2 Inspector is now the default release.

npx @modelcontextprotocol/inspector          # web UI
npx @modelcontextprotocol/inspector --cli    # CLI
npx @modelcontextprotocol/inspector --tui    # TUI

What's new

v2 ships as a single package with three clients — a Vite + React + Mantine web UI, a scriptable CLI, and an Ink-based TUI — over a shared @inspector/core runtime, so all three behave identically.

Upgrading from v1

• Node >= 22.19.0 is now required (was >= 22.7.5).
• CLI flags changed substantially. In particular --config now means a read-only session file; --catalog is the writable server list. See MCP server configuration.
• The v1 sub-packages (inspector-client, inspector-server, inspector-cli) are deprecated and not part of v2 — v2 publishes a single package.

v1

v1 is deprecated and receives security fixes only, published under the v1-latest tag:

npm i @modelcontextprotocol/inspector@v1-latest

2.0.0-rc.3

Release candidate for 2.0.0.

Adds the vite 8.1.5 bump on top of rc.2, closing three high-severity dev-server file-read advisories.

Published under the next dist-tag — latest remains on 1.0.1.

Install: npx @modelcontextprotocol/inspector@next

Prerelease for validating the publish pipeline (#1818). Not for general use.

2.0.0-rc.2

Release candidate for 2.0.0, with all runtime dependency vulnerabilities cleared.

Published under the next dist-tag — latest remains on 1.0.1.

Install: npx @modelcontextprotocol/inspector@next

Prerelease for validating the publish pipeline against the swept dependency tree (#1818). Not for general use.

2.0.0-rc.1

Release candidate for 2.0.0. Published under the next dist-tag — latest remains on 1.0.1.

... (truncated)

Commits

• 7aebf16 chore: 2.0.0 (#1842)
• 73fe059 fix(deps): raise vite to 8.1.5 to close three dev-server file-read advisories...
• d5e35b5 chore: clear all runtime dependency vulnerabilities; 2.0.0-rc.2 (#1837)
• 954f9e8 fix(ci): publish via OIDC trusted publishing, not a non-existent NPM_TOKEN (#...
• 75e3116 chore: 2.0.0-rc.1 (#1835)
• 1450029 ci: derive the npm dist-tag from the version instead of defaulting to latest ...
• 8445675 chore(deps): upgrade @​hono/node-server to 2.0.12 (#1832)
• 809b9fd ci: set a least-privilege default GITHUB_TOKEN scope (#1831)
• 25106dc Merge pull request #1830 from modelcontextprotocol/chore/v2-golive
• ec5d8e1 chore: replace main's tree with v2
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/inspector since your current version.

Install script changes

This version adds postinstall script that runs during installation. Review the package contents before updating.

Updates nodemon from 3.1.11 to 3.1.14

Release notes

Sourced from nodemon's releases.

v3.1.14

3.1.14 (2026-02-20)

Bug Fixes

• get watch working on windows (cfebe2f), closes #2270

v3.1.13

3.1.13 (2026-02-19)

Bug Fixes

• TypeScript definition for 'restart' args (5c03715), closes #2265

v3.1.12

3.1.12 (2026-02-19)

Bug Fixes

• bump minimatch (9376af3), closes #2267

Commits

• cfebe2f fix: get watch working on windows
• f34bfa9 chore: fix release to run after tests
• 5c03715 fix: TypeScript definition for 'restart' args
• 28de4b7 chore: semver-release wanted 22-24 🤦
• 6217164 chore: move release workflow to node 20
• 2c458de chore: bump semver-release + update workflow
• 9376af3 fix: bump minimatch
• e045423 chore: website
• f7a4edd chore: website
• f26223f chore: website
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemon since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.