consider switching to brace-expansion

[43081j]

👋 as part of the efforts going on over at the ecosystem-cleanup repo, we're helping projects move away from various packages to reduce dependency bloat

braces is one such package.

in most places, we can use brace-expansion as a drop-in replacement instead (4-5x smaller, only 1 dependency)

i'd be happy to open a PR with the change if you're happy with it

[paulmillr]

It's probably much slower.

[dave-addition]

Sort of related: CVE-2024-4068 on braces was just made public (see also: micromatch/braces#35).

Hopefully that project fixes it, but... last publish was 5 years ago so we'll see.

[paulmillr]

tired of these useless "vulnerabilities"

[dave-addition]

I sympathize!