fix: resolve brace-expansion ReDoS vulnerability (CVE-2025-5889)

[tenequm]

Fixes a Regular Expression Denial of Service (ReDoS) vulnerability in the brace-expansion dependency.

Description

This PR resolves CVE-2025-5889 by updating the vulnerable brace-expansion package from version 2.0.1 to 2.0.2. The vulnerability allowed attackers to cause significant CPU consumption through crafted inputs with deeply nested braces, potentially leading to denial of service.

Server Details

• Server: filesystem
• Changes to: dependencies (package-lock.json only)

Motivation and Context

This change addresses a security vulnerability (CVE-2025-5889) that affects the brace-expansion package, which is an indirect dependency through minimatch and glob packages used by the filesystem server. The vulnerability could allow attackers to cause denial of service through ReDoS attacks.

Fixes #2700

How Has This Been Tested?

• Ran npm audit to verify the vulnerability was resolved (0 vulnerabilities found)
• Executed full test suite for the filesystem package: all 127 tests pass
• Verified that glob and minimatch functionality continues to work correctly
• No code changes were required, only dependency update

Breaking Changes

None. This is a patch-level security update with no API changes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follows MCP security best practices
• I have updated the server's README accordingly (no changes needed for dependency update)
• I have tested this with an LLM client
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (no code changes required)
• I have documented all environment variables and configuration options (not applicable)

Additional context

• CVE: CVE-2025-5889
• Severity: Low (CVSS 3.1 Score: 3.1)
• Affected versions: brace-expansion 2.0.0 - 2.0.1
• Fixed version: brace-expansion 2.0.2
• Update performed via: npm audit fix