UI Extensions toolchain installs brace-expansion@2.1.2 affected by GHSA-mh99-v99m-4gvg

Extensions
1

The current Customer Account UI Extension dependency chain installs
brace-expansion@2.1.2 through:

@shopify/ui-extensions
→ ts-morph
→ @ts-morph/common
→ minimatch@9.0.9
→ brace-expansion@2.1.2

Environment and versions:

  • Node.js 24.13.1
  • npm 11.8.0
  • @shopify/ui-extensions 2026.4.0
  • ts-morph 25.0.1
  • @ts-morph/common 0.26.1
  • minimatch 9.0.9
  • brace-expansion 2.1.2

npm audit reports GHSA-mh99-v99m-4gvg as high severity. In our tested app, a
clean production Shopify app build did not include ts-morph, minimatch, or
brace-expansion in the generated UI extension bundles, source-map inputs, or
metafile inputs. They remain installed in the package dependency graph, but we
found no evidence that they are included in the deployable UI runtime
artifacts.

Reproduction:

  1. Run npm ci from a clean checkout.
  2. Run npm explain minimatch --json.
  3. Run npm explain brace-expansion --json.
  4. Run npm audit --json.
  5. Run
    npm exec --offline -- shopify app build --config production --no-color --skip-dependencies-installation.

We inspected the generated UI bundles, source maps, metafile input lists, and
external imports. None references minimatch, brace-expansion, ts-morph, or
@ts-morph/common.

Could the supported UI Extensions dependency chain be updated to versions of
ts-morph / @ts-morph/common that use a non-affected minimatch and
brace-expansion version?

We do not want to force an incompatible minimatch major through an application
override, because @ts-morph/common 0.26.1 declares minimatch ^9.0.4 and npm
reports an override to minimatch 10 as an invalid dependency tree.

The smallest preferred fix is a compatible @shopify/ui-extensions dependency
update whose ts-morph/@ts-morph/common chain permits a patched minimatch and
brace-expansion release.