fix(vscode): bound brace-expansion resolution to avoid poisoned 5.x#467
Merged
Conversation
The resolutions entry "brace-expansion": ">=2.1.2" had no upper bound, so yarn resolved it to the poisoned 5.0.7 release whose changed export shape breaks minimatch's default import, crashing `yarn lint` with "brace_expansion_1.default is not a function". Bound the range to ">=2.1.2 <3" (keeping the CVE-safe lower bound from #445) and regenerate yarn.lock. brace-expansion now resolves to 2.1.2 and its transitive balanced-match back to 1.0.2. Lint, compile and the 92 unit tests all pass.
Contributor
|
✅ OpenCodeReview: No comments generated. Looks good to me. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bound the
brace-expansionyarn resolution from the unbounded>=2.1.2to>=2.1.2 <3, and regenerateextensions/vscode/yarn.lock.Why
The
resolutionsentry added in #445 ("brace-expansion": ">=2.1.2") had no upper bound, so yarn resolved it to the poisoned5.0.7release. brace-expansion 5.x changed its export shape, sominimatch'simport expand from 'brace-expansion'getsundefined, crashingyarn lintwithbrace_expansion_1.default is not a function.This went unnoticed because the lint workflow (
vscode-ext.yml, #444) was added ~4.5h after #445 merged, and it only runs on PRs touchingextensions/vscode/**— never on push to main. All recent dependabot PRs failed identically, inheriting main's poisoned lockfile.Changes
package.json:brace-expansionresolution>=2.1.2->>=2.1.2 <3(keeps the CVE-safe lower bound from fix(vscode): resolve 5 high-severity npm dependency vulnerabilities #445, blocks the 5.x major).yarn.lock:brace-expansion5.0.7->2.1.2; transitivebalanced-match4.0.4->1.0.2.Verification
yarn lint— 0 errorsyarn compile— successyarn test— 10 suites / 92 tests pass