[maxigimenez]

Owner: @maxigimenez

Clears GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) in both brace-expansion resolutions. Found by npm audit — Vanta files no record for this repository, so this advisory carried no SLA clock and no Dependabot PR.

What changed

package	from	to	scope	via
brace-expansion	5.0.9	5.0.12	development	eslint → minimatch
brace-expansion	2.1.4	2.1.7	development	ts-jest → … → test-exclude → glob → minimatch

minimatch requests ^5.0.8 and ^2.0.2; both already admit the fixed versions, so this is a lockfile refresh with no manifest edit. Diff is package-lock.json alone, 6 insertions / 6 deletions across exactly 2 stanzas.

The version/resolved/integrity fields were edited in place rather than letting npm install rewrite the file, because the npm in this sandbox (10.9.4) strips the libc discriminators this lockfile carries on 8 optional binaries — 48 unrelated deletions. npm ci accepts the result and leaves it byte-identical, and the dependency and engine fields of both packages are unchanged between the old and new versions.

Exposure

Development only. npm ls brace-expansion --omit=dev returns an empty tree — no copy reaches the runtime dependencies (@actions/core, @actions/exec, lodash), and dist/ is byte-identical after npm run package, so the published action bundle is unaffected. The advisory bites code that passes an untrusted pattern to expand() via minimatch/glob; here the only callers are ESLint's ignore matching and Jest's coverage path matching, both over patterns committed in this repo.

Breaking-change check

v5.0.11...v5.0.12 is two commits. The fix bounds how many times the scan may restart (maxRewrites, default 1000); past the bound the remaining string is returned literally instead of expanding. The author reports the quadratic case dropping from 27.7s to ~50ms at n=128,000 and output equivalence below the bound by differential testing. No removals and no breaking-change section. That bound is a real behaviour change, but only for patterns needing more than 1000 rewrites — far past anything in this repo's lint and coverage globs.

GitHub rates the advisory moderate, CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); npm audit surfaces it as high.

Verification

Run on this branch at d0ca8e6:

command	result
npm ci	clean, integrity hashes validate, lockfile unchanged
git diff --name-only	package-lock.json only
npm run format:check	pass
npm run lint	pass
npm test	39/39 passed, 1 suite
npm run package	dist/ byte-identical, so check-dist passes
npm audit	1 high + 1 moderate → 1 moderate (the remaining one is @humanfs/node, unrelated)
peer warnings	42 UNMET OPTIONAL DEPENDENCY lines before and after — 0 new

CI coverage

All five workflows trigger on pull_request to main with no paths filter, so none is skipped by a lockfile-only diff: check-dist, codeql-analysis, linter, test, unit-tests.

What a human should still check

Nothing. Tier A: patch bumps inside one major each, transitive and development-only, no manifest edit, no patch files in this repo, 2 lockfile stanzas, no majors collapsed, no new peer warnings.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Update the development dependency lockfile to resolve both brace-expansion versions affected by GHSA-q2hr-2g5m-vwhr, preserving existing dependency ranges and package metadata. Keep runtime dependencies and the published bundle unchanged while refreshing version, resolved, and integrity entries.

Latest Contributors(2)

User	Commit	Date
maxi@currents.dev	fix(deps): bump brace-...	October 23, 2026
dj@currents.dev	chore: update dependen...	August 07, 2026

---

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}

[maxigimenez]

Triage verdict — Tier A, ready to merge, nothing outstanding

This is a Phase 5 auto-merge candidate. The check that makes it one: every entry the fix moves is development-scope, confirmed with npm ls rather than from the manifest.

$ npm ls brace-expansion --all
playwright-last-failed@2.1.0
+-- eslint@10.12.0
| `-- minimatch@10.2.6
|   `-- brace-expansion@5.0.12
`-- ts-jest@29.4.14
  `-- @jest/transform@30.5.2
    `-- babel-plugin-istanbul@8.0.0
      `-- test-exclude@7.0.2
        `-- glob@10.5.0
          `-- minimatch@9.0.9
            `-- brace-expansion@2.1.7

$ npm ls brace-expansion --omit=dev --all
playwright-last-failed@2.1.0
`-- (empty)

Both paths enter through eslint and ts-jest. The runtime tree holds no copy, so there is no path that reaches the published action — and dist/ is byte-identical after npm run package, which is the independent check on that claim.

Why this one and not the others in today's queue

condition	this PR
Tier A on the full rubric	yes — patch bumps in one major each, 2 lockfile stanzas, no manifest edit, no patch files, no majors collapsed, 0 new peer warnings
every moved entry development-scope	yes — npm ls --omit=dev empty
no package on the sensitive-by-name list	yes — brace-expansion is not on it
diff is lockfile + at most one manifest	yes — package-lock.json alone, 6/6 lines
verified in this run against this head	yes — npm ci, format:check, lint, test 39/39, package
every triggered workflow green on the head SHA	yes — 5/5 on d0ca8e6, listed below
no review requests changes, nothing unresolved	yes
merges cleanly	yes — mergeable_state: clean, base is current main

By contrast, today's other security PRs each fail at least one: #468 in currents-reporter and #240 in currents-mcp move runtime entries of published packages, and #1006 in currents-playwright, #4485/#4486 in currents are Tier B on lockfile size or a red check. Those stay open for a human.

CI on d0ca8e6

All five workflows that this diff triggers ran and concluded success — none is paths-filtered, so none was skipped:

workflow	conclusion
Check Transpiled JavaScript	success
Test Action	success
Unit tests action	success
CodeQL	success
Lint Codebase	success

Not found by Vanta

npm audit found this; Vanta has no finding for currents-dev/playwright-last-failed at all, so it carried no SLA deadline and Dependabot opened nothing. That gap is the reason this sat unfixed, and it is reported in today's digest alongside the same gap in currents-dev/ide-extension.

---

Generated by Claude Code