Build dependency chain installs brace-expansion@2.1.2 affected by GHSA-mh99-v99m-4gvg

Start with a clean checkout and run npm ci, then use npm explain minimatch --json, npm explain brace-expansion --json, and npm audit --json to trace the build dependency chain. Review the Shopify Function and graphql-config dependency ranges; done means the supported build dependencies resolve to an unaffected compatible minimatch/brace-expansion combination without an out-of-range consumer override.

Summary

The current Shopify Function JavaScript toolchain installs
brace-expansion@2.1.2 through minimatch@9.0.9. npm audit reports
GHSA-mh99-v99m-4gvg as high severity.

Environment and versions

• Node.js 24.13.1
• npm 11.8.0
• @shopify/shopify_function 2.0.1
• graphql-config 5.1.3
• minimatch 9.0.9
• brace-expansion 2.1.2

Reproduction

In a Shopify app with a JavaScript Function extension:

1. Run npm ci from a clean checkout.
2. Run npm explain minimatch --json.
3. Run npm explain brace-expansion --json.
4. Run npm audit --json.

The Function workspace reaches the affected package through the Shopify
Function/code-generation build chain, including graphql-config/minimatch.

The production app build was generated with:

npm exec --offline -- shopify app build --config production --no-color --skip-dependencies-installation

We checked the generated Function JavaScript and WASM with static byte/string
searches and found no minimatch, brace-expansion, or graphql-config package
reference. We therefore believe this is a build-tool dependency, but still
fail our dependency audit until it is resolved or narrowly reviewed.

Forcing minimatch 10 as a consumer override is not a safe workaround:
graphql-config 5.1.3 declares minimatch ^9.0.5, so npm reports the dependency
tree as invalid.

Expected result

The supported Function build dependencies should resolve to a minimatch /
brace-expansion combination that is not affected by
GHSA-mh99-v99m-4gvg.

The smallest preferred fix is a compatible Shopify Function dependency update
whose graphql-config/minimatch ranges support a patched brace-expansion
release, without requiring consumers to force an out-of-range major override.

Additional context

The package is used by the build toolchain and is not imported by the
generated Function JavaScript or WASM artifact in our verification. We are
still treating the audit result as fail-closed and would prefer an upstream
dependency update over an incompatible package override.