fix(security): auto-remediate fixable vulnerabilities

.changeset/auto-security-remediation.md

@@ -0,0 +1,9 @@
+---
+"@checkstack/backend": patch
+"@checkstack/scripts": patch
+---
+
+Security: auto-remediated fixable vulnerabilities flagged by the daily scan.
+
+- `tar` 7.5.20 → 7.5.21 (GHSA-r292-9mhp-454m)
+- `brace-expansion` 5.0.7 → 5.0.8 (CVE-2026-14257)

core/backend/package.json

@@ -43,7 +43,7 @@
     "jose": "^6.2.3",
     "pg": "^8.11.0",
     "semver": "^7.8.1",
-    "tar": "^7.5.16",
+    "tar": "^7.5.21",
     "winston": "^3.19.0",
     "zod": "^4.2.1"
   },

core/scripts/package.json

@@ -34,7 +34,7 @@
     "handlebars": "^4.7.8",
     "inquirer": "^13.4.1",
     "react": "^19.0.0",
-    "tar": "^7.5.16",
+    "tar": "^7.5.21",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package.json

@@ -82,7 +82,8 @@
     "@astrojs/markdown-remark": "^7.2.0",
     "adm-zip": "^0.6.0",
     "fast-uri": "^3.1.4",
-    "sharp": "^0.35.0"
+    "sharp": "^0.35.0",
+    "brace-expansion": "^5.0.8"
   },
   "resolutions": {
     "drizzle-orm": "^0.45.0",
@@ -98,6 +99,7 @@
     "@astrojs/markdown-remark": "^7.2.0",
     "adm-zip": "^0.6.0",
     "fast-uri": "^3.1.4",
-    "sharp": "^0.35.0"
+    "sharp": "^0.35.0",
+    "brace-expansion": "^5.0.8"
   }
 }

security/managed-overrides.json

@@ -72,6 +72,14 @@
       "reason": "Auto-remediated by Security Maintenance: sharp 0.34.5 had fixable advisories; pinned to the fixed 0.x line.",
       "addedAt": "2026-07-23",
       "removeWhen": "No dependency resolves below 0.35.0 without this override."
+    },
+    "brace-expansion": {
+      "safeFloor": "5.0.8",
+      "severity": "HIGH",
+      "advisory": "CVE-2026-14257",
+      "reason": "Auto-remediated by Security Maintenance: brace-expansion 5.0.7 had fixable advisories; pinned to the fixed 5.x line.",
+      "addedAt": "2026-07-30",
+      "removeWhen": "No dependency resolves below 5.0.8 without this override."
     }
   },
   "intentional": {