diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1eb5d8f..09fd647 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -13,7 +13,7 @@ overrides:
   fast-uri@<3.1.5: '>=3.1.5 <4'
   sharp@<0.35.0: '>=0.35.0'
   minimatch@<10: '>=10 <11'
-  brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8'
+  brace-expansion@<5.0.9: '>=5.0.9'
 
 importers:
 
@@ -1540,10 +1540,6 @@ packages:
   bowser@2.14.1:
     resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
-    engines: {node: 20 || >=22}
-
   brace-expansion@5.0.9:
     resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
@@ -4394,10 +4390,6 @@ snapshots:
 
   bowser@2.14.1: {}
 
-  brace-expansion@5.0.8:
-    dependencies:
-      balanced-match: 4.0.4
-
   brace-expansion@5.0.9:
     dependencies:
       balanced-match: 4.0.4
@@ -5070,7 +5062,7 @@ snapshots:
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
 
   minimatch@10.2.6:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f02508a..aaf5f74 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -39,8 +39,14 @@ overrides:
   # below 5.0.7, so the old 1.x/2.x lines stay flagged no matter how far we patch
   # inside them. They only existed because glob@7 (archiver-utils, rimraf@2) and
   # readdir-glob@1 (archiver, via exceljs) pull minimatch 3.x/5.x, so lift
-  # minimatch itself to 10 — it depends on brace-expansion ^5, which leaves 5.0.8
-  # as the single copy in the tree. Both consumers construct `new Minimatch(...)`
-  # rather than calling the export as a function, which is what breaks under 10.
+  # minimatch itself to 10 — it depends on brace-expansion ^5, which leaves a
+  # single copy in the tree. Both consumers construct `new Minimatch(...)` rather
+  # than calling the export as a function, which is what breaks under 10.
+  #
+  # GHSA-rgw5-rvv9-x895 is the third round: unbounded intermediate arrays, which
+  # bypasses the CVE-2026-14257 mitigation, fixed in 5.0.9. Note the shape of the
+  # bound below — it tracks the newest advisory rather than the range of one
+  # specific report, because an override whose floor sits a generation too low
+  # looks resolved while leaving the flagged version installed.
   "minimatch@<10": ">=10 <11"
-  "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8"
+  "brace-expansion@<5.0.9": ">=5.0.9"