From d0ca8e60b1ee1f34b6a6bcb6521b5c702e02703c Mon Sep 17 00:00:00 2001 From: maxigimenez Date: Fri, 23 Oct 2026 09:13:30 +0000 Subject: [PATCH] fix(deps): bump brace-expansion to 5.0.12 and 2.1.7 in the lockfile Both resolutions sat in the vulnerable range of GHSA-q2hr-2g5m-vwhr (CVE-2026-102277): expand() rescans the input each time it rewrites a brace group, so a pattern reaching minimatch or glob costs quadratic time. 5.0.12 and 2.1.7 bound the rescan count. minimatch requests ^5.0.8 and ^2.0.2, both of which already admit the fixed versions, so only the lockfile changes. Both resolutions are reachable only through eslint and ts-jest; the runtime tree carries no copy of brace-expansion. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Aw6HKYzX21czRB8siJuYpN --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 07ad02f..c9ca35a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2820,9 +2820,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { @@ -5635,9 +5635,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": {