Skip to content

Add opt-in { max } mitigation to v1 legacy line - #103

Merged
juliangruber merged 2 commits into
juliangruber:v1from
vitolob:backport-ghsa-7h2j-956f-4vf2-v1
Apr 11, 2026
Merged

juliangruber merged 2 commits into
juliangruber:v1from
vitolob:backport-ghsa-7h2j-956f-4vf2-v1

Conversation

@vitolob

@vitolob vitolob commented Apr 4, 2026

Copy link
Copy Markdown

Revise the v1 backport to keep default behavior unchanged and add only an opt-in { max } option.

This avoids a breaking change on the legacy line while still giving direct consumers a way to limit expansion size if they choose to stay on v1.

Included:

  • opt-in { max } support
  • recursive propagation of max
  • test coverage for truncation
  • test coverage showing default behavior is unchanged

References:

Refs #99 #100

@juliangruber
juliangruber merged commit 1afa1b2 into juliangruber:v1 Apr 11, 2026
20 checks passed
@juliangruber

Copy link
Copy Markdown
Owner
+ brace-expansion@1.1.14

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants