plugin-cloud-storage: unused find-node-modules dependency pulls in braces (GHSA-vfj7-8cjw-p6xm, no patched version) #18623

Describe the Bug

@payloadcms/plugin-cloud-storage declares find-node-modules as a runtime dependency, but no code in the package uses it. Because of it, every app using any @payloadcms/storage-* adapter inherits this chain:

@payloadcms/storage-s3 > @payloadcms/plugin-cloud-storage > find-node-modules@2.1.3 > findup-sync@4.0.0 > micromatch@4.0.8 > braces@3.0.3

npm audit reports 6 high findings for GHSA-vfj7-8cjw-p6xm. The advisory covers braces <= 3.0.3 and lists no patched version. The braces maintainer has rejected the report (micromatch/braces#70), so a fixed release is unlikely, and micromatch 4.0.8 / findup-sync 5.0.0 are already the latest versions. Users can't fix this with overrides.

Evidence that the dependency is unused:

• main (c27fe28): find-node-modules appears only in packages/plugin-cloud-storage/package.json (dependencies line 63, @types/find-node-modules in devDependencies line 67). GitHub code search for find-node-modules and findNodeModules finds no other file.
• Published 3.90.2: none of the 125 files in dist/ reference it.
• Runtime: booting Payload 3.90.2 with @payloadcms/storage-s3 under a module.registerHooks resolve logger resolved 5,581 modules and never loaded find-node-modules, findup-sync, micromatch or braces. A control run that required find-node-modules directly was caught by the same hook.
• next build (16.4.0): no .nft.json trace or server chunk includes any of the four packages.

Proposed fix: remove find-node-modules from dependencies and @types/find-node-modules from devDependencies in packages/plugin-cloud-storage/package.json. Happy to open the PR.

Link to the code that reproduces this issue

Reproduction Steps

1. npm init -y && npm i @payloadcms/storage-s3@3.90.2
2. npm audit
3. See 6 high findings for braces (GHSA-vfj7-8cjw-p6xm) through @payloadcms/plugin-cloud-storage > find-node-modules.
4. grep -rn "find-node-modules" node_modules/@payloadcms/plugin-cloud-storage/dist returns nothing.

Which area(s) are affected?

plugin: cloud-storage, plugin: storage-*

Environment Info

Binaries:
  Node: 24.21.0
  npm: 12.2.0
Relevant Packages:
  payload: 3.90.2
  next: 16.4.0
  @payloadcms/plugin-cloud-storage: 3.90.2
  @payloadcms/storage-s3: 3.90.2
  react: 19.3.0
Operating System: macOS (Darwin 27.0.0)