Update brace-expansion library - #287
Conversation
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Verified against the GitHub Advisory Database and the npm registry. This resolves high-severity CVE-2026-14257 (GHSA-mh99-v99m-4gvg, DoS via unbounded expansion -> OOM): each old version here (1.1.16, 2.1.2 x2, 5.0.7) fell in a vulnerable range, and all four are bumped to patched releases (1.1.18, 2.1.4, 5.0.9). The new versions sit outside all 6 advisories' vulnerable ranges, are the latest in each series (npm |
| "version": "5.0.7", | ||
| "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", | ||
| "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", | ||
| "version": "5.0.9", |
There was a problem hiding this comment.
5.0.7 was in the vulnerable range >=4.0.0,<5.0.8 for high-severity CVE-2026-14257 (OOM DoS); 5.0.9 is past the 5.0.8 fix and matches npm's latest dist-tag, and isn't in any other advisory's range. The upstream engines change here (drops node 18) is harmless since this is a dev-only nested dep and the repo targets node 24. — GLM-5.2
| "version": "1.1.16", | ||
| "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", | ||
| "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", | ||
| "version": "1.1.18", |
There was a problem hiding this comment.
1.1.16 sat just below the 1.1.17 fix for high-severity CVE-2026-14257; 1.1.18 is the latest 1.x and clears every advisory (oldest being CVE-2017-18077, fixed at 1.1.7). No advisory's vulnerable range covers 1.1.18, so this introduces no known regression. — GLM-5.2
| "version": "2.1.2", | ||
| "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", | ||
| "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", | ||
| "version": "2.1.4", |
There was a problem hiding this comment.
2.1.2 was in >=2.0.0,<2.1.3 for CVE-2026-14257; 2.1.4 is past the 2.1.3 fix and the latest 2.x. The identical 2.1.2 -> 2.1.4 bump under node_modules/glob (line 4850) is covered by the same reasoning. — GLM-5.2
No description provided.