Co-authored-by: Victorino Machava <victorino.machava@vm.co.mz>

This reverts commit 0d7652e.

* Backport fix for GHSA-7h2j-956f-4vf2 to v1

* Remove `EXPANSION_MAX` and default to unbounded expansion

---------

Co-authored-by: Victorino Machava <victorino.machava@vm.co.mz>

Co-authored-by: Siddharth Srinivasan <175113207+sid-srini@users.noreply.github.com>

* fix: backport for CVE-2026-13149

* fix: backport for CVE-2026-13149

* Consistency with v5 patch

* Consistency with v5 patch

* Consistency with v5 patch

* Update test/unbound-recursion.js

* Update test/unbound-recursion.js

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>

* fix: default to a `max` of `100000`

* fix: backport GHSA-mh99-v99m-4gvg

* test: adopt the bounded default max on v1

The backport changes the default `max` from `Infinity` to `EXPANSION_MAX`
(100,000), matching v5. `test/sequence.js` still asserted the old
unbounded behaviour, so the suite was red. Update both assertions to the
capped default and add a single-sequence case exercising the cap.

Otherwise keep 1.x's observable behaviour untouched, so this ships the
vulnerability fixes and nothing else. Two places had drifted:

`${` no longer suppressed expansion of the rest of the string. Expanding
the tail matches bash and the 2.x and 5.x lines, but it is a breaking
change for 1.x, so return the remainder as a single literal as before -
routed through `combine`, so `max` and `maxLength` still bound it.
`test/dollar.js` only covered inputs where every group is `${`-prefixed
and so could not detect this; widen it.

Empty results were dropped against the whole string rather than against
the current run. The old implementation recursed on `m.post`, so the drop
tested only the expansion of the call's own substring, and the `{a},b}`
rewrite starts a fresh such run part-way through a string by turning
`isTop` back on. Collapsing that recursion into one accumulator lost the
distinction, so `{a,b}{},}` gained two results. Track how much of each
accumulator entry predates the current run and drop against that.

Also fix the `maxLength` README example, which used a budget of 100
against ~1500-character expansions and so documented a result that is
actually `[]`, and note that `expand` takes options in the API heading.

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>

* test: backport

* fix: bound expansion length across comma alternatives and sequences

* fix: don't count dropped empties against `max`

Capping the intermediate `values` array at `max` entries counted
alternatives that `combine` goes on to drop as empty, so `max` stopped
bounding the number of *kept* results: `expand('{a,,b}', { max: 2 })`
returned `['a']` where it used to return `['a', 'b']`.

Skip those values rather than counting them. The cap itself stays - it is
what bounds the array when the values are empty and so contribute no
characters for `maxLength` to see.

---------

Co-authored-by: Gareth Jones <3151613+G-Rath@users.noreply.github.com>