From 65c11c63b7cae6e9e9a1be053e5aa014c01bd84f Mon Sep 17 00:00:00 2001 From: madhavilosetty-intel Date: Wed, 26 Aug 2026 12:27:13 -0700 Subject: [PATCH] build(deps): override brace-expansion to ^5.0.9 to fix DoS advisory Resolves GHSA-rgw5-rvv9-x895 (high): brace-expansion 4.0.0-5.0.8 is vulnerable to DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation. minimatch requests ^5.0.5 but npm kept resolving 5.0.8, so an explicit override pins the patched 5.0.9. npm audit now reports 0 vulnerabilities. --- package-lock.json | 6 +++--- package.json | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index a5ee60e8..e16a15cb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2908,9 +2908,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index b4f76b17..9317eeaf 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,8 @@ }, "overrides": { "glob": "^13.0.6", - "test-exclude": "^7.0.1" + "test-exclude": "^7.0.1", + "brace-expansion": "^5.0.9" }, "devDependencies": { "@eslint/js": "^10.0.1",