rollup-plugin-copy is in runtime dependencies, pulling a vulnerable glob@7/brace-expansion@1 chain into all consumers

[ohcedar]

Summary

rollup-plugin-copy — a Rollup build plugin — is listed in SuperDoc's runtime dependencies rather than devDependencies. Because it is a runtime dep, every consumer installs it, and with it a transitive chain that currently carries a brace-expansion advisory with no patched version available in the required major.

Moving it to devDependencies would remove the chain for all consumers.

The chain

@harbour-enterprises/superdoc@1.45.0
└─ rollup-plugin-copy@3.5.0        (dependencies, ^3.5.0)
   └─ globby@10.0.1
      └─ glob@7.2.3
         └─ minimatch@3.1.5
            └─ brace-expansion@1.1.16

rollup-plugin-copy is the only consumer of globby in the installed tree, and globby the only consumer of glob@7, so the whole chain exists solely because of this one entry.

Why it's a problem for consumers

The brace-expansion advisory affects <= 5.0.7 and is patched only in 5.0.8. There is no patched 1.x. So a consumer has no in-range remediation:

• npm audit fix cannot help — nothing in the 1.x line is patched.
• npm's only offered resolution is a downgrade of @harbour-enterprises/superdoc to 0.4.41, which is not viable.
• An overrides entry forcing brace-expansion@^5.0.8 silences the audit, but it is not a clean fix: brace-expansion 5's CommonJS entry exports an object ({ EXPANSION_MAX, EXPANSION_MAX_LENGTH, expand }), whereas minimatch@3.1.5 does var expand = require('brace-expansion') and calls the import as a function. The override therefore leaves minimatch@3 functionally broken. It's tolerable only because this chain is never executed — which is precisely the point of this issue.
• npm overrides can change versions but cannot remove a dependency, and patch-package runs post-install, so consumers cannot drop the chain themselves. The fix has to be upstream.

Evidence it is build-only

On the published 1.45.0 tarball:

• package.json files is ["dist", "AGENTS.md"].
• grep -r "rollup-plugin-copy\|globby" dist/ returns no matches — neither package is referenced anywhere in the shipped code.

So nothing in the published output can reach it at runtime; it is only needed to build SuperDoc itself.

Suggested fix

Move rollup-plugin-copy from dependencies to devDependencies.

Possibly worth a look at the same time (lower confidence, and intentional if the shipped .d.ts files reference these types publicly): @types/mdast and @types/ws are also in runtime dependencies.

Environment

• @harbour-enterprises/superdoc@1.45.0 (current latest)
• npm 11 / Node 22
• Verified against the published registry package, not just a local node_modules

[linear-code]

IT-1320