Security vulnerability affects the renovate package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix.