From 56b9dcc207efcb834e5aa58c89e351a5052057db Mon Sep 17 00:00:00 2001 From: Revopush Date: Wed, 29 Jul 2026 21:25:36 +0300 Subject: [PATCH] Fix brace-expansion DoS advisories (REV-72) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears two high-severity Dependabot advisories on brace-expansion: - GHSA-3jxr-9vmj-r5cp: DoS via exponential-time expansion of consecutive non-expanding {} groups (patched in 1.1.16 / 2.1.2). - GHSA-mh99-v99m-4gvg (CVE-2026-14257): DoS via unbounded expansion length causing an OOM crash; patched in 5.0.8 and backported to 1.1.17 / 2.1.3. Both installed copies were stale relative to their own semver ranges, so `npm update brace-expansion` was sufficient — lockfile-only, no override entry and no manifest change: - rimraf@2 -> glob@7 -> minimatch@3 (also eslint): 1.1.15 -> 1.1.17. Reachable from the production tree. - mocha@11 -> minimatch@9: 2.1.1 -> 2.1.3. Dev-only. Deliberately not overridden to 5.0.8: brace-expansion 5.x exports a named `expand` (exports.expand = expand) while minimatch does `const expand = require('brace-expansion')`, so forcing 5.x would break glob/rimraf/eslint/mocha at runtime. The maintenance backports are the fix. Verified against the installed copies: normal expansion unchanged (a{b,c}d{1..3} -> abd1,abd2,abd3,acd1,acd2,acd3 on both); 40 consecutive empty {} groups expand in 0ms; 6 chained 200KB groups now cap at 3.6M chars via the new EXPANSION_MAX_LENGTH=4000000 guard instead of growing unbounded. tsc --noEmit clean; eslint and mocha still resolve their globs. Note: npm audit and Dependabot will keep flagging GHSA-mh99-v99m-4gvg until GitHub amends it — the advisory declares one flat range `<= 5.0.7` with first_patched_version 5.0.8 and has not yet been updated for the 1.1.17 / 2.1.3 backports published 2026-07-28/29. The installed code is patched. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index c97390c..3cccca6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1493,9 +1493,10 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.17", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.17.tgz", + "integrity": "sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==", + "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" @@ -3540,10 +3541,11 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.3.tgz", + "integrity": "sha512-DRdx5neNsG/QXbniLFWi2YmC/68oeOOmKz6zOjVk6ZS1ZLXgLIKqVEc6hWsmkjBbgii0SwaBTcJ5XKj5gzY/4A==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" }