From 46c238a3efb2969392eb97d77fcef126aee7e99c Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Mon, 17 Aug 2026 23:15:08 +0200 Subject: [PATCH] fix(deps): raise the brace-expansion override floor to 5.0.9 GHSA-rgw5-rvv9-x895 is the third brace-expansion DoS advisory: unbounded intermediate arrays, which bypasses the CVE-2026-14257 mitigation. It is fixed in 5.0.9 and flags everything below that, including the 5.0.8 the existing override pinned to. The override was written as a range around the previous report (>=3.0.0 <5.0.8), so it read as resolved while still allowing a flagged version to install. Rewrite it as a plain floor against the newest advisory instead, which is the shape that survives the next round. The tree had both 5.0.8 and 5.0.9 installed, pulled in by minimatch 10.2.5 and 10.2.6. The lockfile change is otherwise removals: 5.0.9 is now the single copy. Same major, so no repeat of the callable-export break that made the jump to 5.x awkward. Verified anyway, since the consumers sit under exceljs at runtime: an xlsx write/read roundtrip returns brace literals and umlauts unchanged. --- pnpm-lock.yaml | 12 ++---------- pnpm-workspace.yaml | 14 ++++++++++---- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1eb5d8f..09fd647 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,7 +13,7 @@ overrides: fast-uri@<3.1.5: '>=3.1.5 <4' sharp@<0.35.0: '>=0.35.0' minimatch@<10: '>=10 <11' - brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8' + brace-expansion@<5.0.9: '>=5.0.9' importers: @@ -1540,10 +1540,6 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} - engines: {node: 20 || >=22} - brace-expansion@5.0.9: resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} engines: {node: 20 || >=22} @@ -4394,10 +4390,6 @@ snapshots: bowser@2.14.1: {} - brace-expansion@5.0.8: - dependencies: - balanced-match: 4.0.4 - brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -5070,7 +5062,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.9 minimatch@10.2.6: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f02508a..aaf5f74 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -39,8 +39,14 @@ overrides: # below 5.0.7, so the old 1.x/2.x lines stay flagged no matter how far we patch # inside them. They only existed because glob@7 (archiver-utils, rimraf@2) and # readdir-glob@1 (archiver, via exceljs) pull minimatch 3.x/5.x, so lift - # minimatch itself to 10 — it depends on brace-expansion ^5, which leaves 5.0.8 - # as the single copy in the tree. Both consumers construct `new Minimatch(...)` - # rather than calling the export as a function, which is what breaks under 10. + # minimatch itself to 10 — it depends on brace-expansion ^5, which leaves a + # single copy in the tree. Both consumers construct `new Minimatch(...)` rather + # than calling the export as a function, which is what breaks under 10. + # + # GHSA-rgw5-rvv9-x895 is the third round: unbounded intermediate arrays, which + # bypasses the CVE-2026-14257 mitigation, fixed in 5.0.9. Note the shape of the + # bound below — it tracks the newest advisory rather than the range of one + # specific report, because an override whose floor sits a generation too low + # looks resolved while leaving the flagged version installed. "minimatch@<10": ">=10 <11" - "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8" + "brace-expansion@<5.0.9": ">=5.0.9"