Take the brace-expansion and postcss fixes, drop a retired allowlist entry, release 2.7.3

[vvillait88]

Summary

Three advisories were reachable in the lockfile with fixed versions already published: brace-expansion (two High, one per locked copy) and postcss. None had been taken because bun does not re-resolve a locked version that still satisfies its range, so a routine refresh could never reach them. A clean re-lock takes all three and dedupes minimatch and typescript-eslint.

The brace-expansion allowlist entry is deleted rather than waived. It said the 1.x line had no fixed release, which was true when written; upstream has since backported to 1.1.17 and then 1.1.18, and minimatch@3 asks for ^1.1.7, so the fix arrives with no override and none of the API breakage that made forcing 5.x impossible. osv-scanner now reports that entry as an unused ignore, which is what a stale suppression looks like.

The esbuild override stays. Re-tested by removing it: natural resolution is 0.27.7, which carries GHSA-g7r4-m6w7-qqqr, so the floor is still doing work.

Held versions are unchanged: eslint / @eslint/js on 9.x and typescript on 6.x, both deliberate cross-repo decisions rather than routine bumps. typescript-eslint 8.66.0 exists but is inside the 24h release-age soak and will arrive on its own.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported type, signature, wire format or response shape changed. package.json is untouched apart from nothing at all: the diff is the lockfile and the scanner allowlist, so no release is needed and no caller has to act.

Test plan

Run from a clean install (rm -rf node_modules bun.lock && bun install), not a tree left over from an experiment:

• bun run lint exit 0
• bun run typecheck exit 0
• bun run knip exit 0
• bun run build exit 0
• bun run test: 166 passed, 9 skipped
• osv-scanner v2.4.0 (the version CI pins) over bun.lock: no issues found

The override re-test was done in a scratch copy of the manifest so the working tree was never left in a half-resolved state, and the advisory status of both candidate versions was confirmed against the OSV API rather than inferred.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Scope grew after the original body: this branch now also bumps package.json to 2.7.3 for release, so the "no release is needed" line in the Public API section above no longer describes the branch.

The published artifact is still functionally identical to 2.7.2. files is ["dist"], and every dependency change here is dev-only (brace-expansion and postcss arrive through eslint, typescript-eslint and vitest), so nothing that ships changed. 2.7.3 is a maintenance release that carries the advisory-clean lockfile and the retired allowlist entry, not a behavior change, and callers have nothing to migrate.

bun.lock carries no root version field, so unlike the uv side there was nothing to re-lock alongside the bump (checked rather than assumed).

Gates re-run after the bump: lint, typecheck, build all exit 0; tests 166 passed, 9 skipped.