diff --git a/package-lock.json b/package-lock.json
index 17e7e22..3937b72 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -102,9 +102,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -672,9 +672,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.10.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz",
-      "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==",
+      "version": "8.11.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
+      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/scripts/audit.mjs b/scripts/audit.mjs
index 259c3fb..bfff094 100644
--- a/scripts/audit.mjs
+++ b/scripts/audit.mjs
@@ -135,8 +135,8 @@ const lockedVersion = (name) => packageLock.packages?.[`node_modules/${name}`]?.
 if (lockedVersion("node-gyp") !== "13.0.1" || lockedVersion("glob") !== "13.0.6") {
   throw new Error("The native font build chain must use node-gyp 13 and glob 13");
 }
-if (lockedVersion("brace-expansion") !== "5.0.9") {
-  throw new Error("brace-expansion 5.x must remain at the fully patched 5.0.9 release");
+if (lockedVersion("brace-expansion") !== "5.0.12") {
+  throw new Error("brace-expansion 5.x must remain at the fully patched 5.0.12 release");
 }
 for (const obsolete of ["cacache", "make-fetch-happen", "ip-address"]) {
   if (lockedVersion(obsolete)) throw new Error(`Obsolete node-gyp 11 dependency remains: ${obsolete}`);