Denial of service via nested pattern expansion

Deeply nested brace groups expand combinatorially before any bound is applied. Reached wherever a glob pattern crosses a trust boundary.

SyntheticThis advisory is invented for the demonstration. minimatch is a real package; nothing described here has been reported against it.