From 16ab4bc85de599c5ed05976edf4fa741ec4b1ef7 Mon Sep 17 00:00:00 2001 From: Brian Scanlan Date: Fri, 28 Aug 2026 12:44:34 +0100 Subject: [PATCH] security: bump brace-expansion for GHSA-mh99-v99m-4gvg Lockfile-only bump of the transitive brace-expansion dependency to clear GHSA-mh99-v99m-4gvg (CVE-2026-14257, High): unbounded expansion length causes an uncatchable OOM crash. Targets 1.1.18 / 2.1.4 / 5.0.9, which also clear the sibling brace-expansion advisories open at the same time. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01A7XtZXJWpdNvW49CcERj8b --- pnpm-lock.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cc3d4e7d..386f2283 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -366,11 +366,11 @@ packages: bl@4.1.0: resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==} - brace-expansion@1.1.13: - resolution: {integrity: sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.0.3: - resolution: {integrity: sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -2491,12 +2491,12 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - brace-expansion@1.1.13: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.0.3: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 @@ -3560,11 +3560,11 @@ snapshots: minimatch@3.1.5: dependencies: - brace-expansion: 1.1.13 + brace-expansion: 1.1.18 minimatch@5.1.9: dependencies: - brace-expansion: 2.0.3 + brace-expansion: 2.1.4 minimist@1.2.8: {}