From 9b46e54c6b3e592c113dbace484ee722d36bbc45 Mon Sep 17 00:00:00 2001
From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com>
Date: Thu, 8 Oct 2026 11:29:53 +0200
Subject: [PATCH 1/2] fix(deps): override vm2 and bump brace-expansion in
 test-project

---
 test-project/package-lock.json | 30 +++++++++++++++---------------
 test-project/package.json      |  3 +++
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/test-project/package-lock.json b/test-project/package-lock.json
index 24719b5..109d7e2 100644
--- a/test-project/package-lock.json
+++ b/test-project/package-lock.json
@@ -1497,9 +1497,9 @@
       }
     },
     "../node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2236,9 +2236,9 @@
       }
     },
     "../node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4350,9 +4350,9 @@
       }
     },
     "node_modules/@dataform/cli/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4987,9 +4987,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6480,9 +6480,9 @@
       }
     },
     "node_modules/vm2": {
-      "version": "3.11.6",
-      "resolved": "https://registry.npmjs.org/vm2/-/vm2-3.11.6.tgz",
-      "integrity": "sha512-35hVTcKieg7jJMntHhgWT5c2a1J2vmpXm66Xs1Z8ayHOJTj8rzIlXKzba3nO1Om/sonmnkjlAOMt9p8lYJXsWw==",
+      "version": "3.12.2",
+      "resolved": "https://registry.npmjs.org/vm2/-/vm2-3.12.2.tgz",
+      "integrity": "sha512-LRHt4xU6eXshlZEcSZVrTehLGxRDjHvjmFPGwEp4xGpZX61QzH6Xm9wK2nU7XAp36V1w2xILAL1LwxVkgD1Ipw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/test-project/package.json b/test-project/package.json
index 4e1b1ed..94b42e3 100644
--- a/test-project/package.json
+++ b/test-project/package.json
@@ -7,5 +7,8 @@
   },
   "devDependencies": {
     "@dataform/cli": "3.0.71"
+  },
+  "overrides": {
+    "vm2": "^3.11.7"
   }
 }

From c91a616577db4ec7a5f8f6ff48873176de378375 Mon Sep 17 00:00:00 2001
From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com>
Date: Thu, 8 Oct 2026 12:27:15 +0200
Subject: [PATCH 2/2] fix(deps): drop vm2 override in test-project; breaks
 Dataform 2.4.2/3.0.48 matrix

---
 test-project/package-lock.json | 6 +++---
 test-project/package.json      | 3 ---
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/test-project/package-lock.json b/test-project/package-lock.json
index 109d7e2..4559d88 100644
--- a/test-project/package-lock.json
+++ b/test-project/package-lock.json
@@ -6480,9 +6480,9 @@
       }
     },
     "node_modules/vm2": {
-      "version": "3.12.2",
-      "resolved": "https://registry.npmjs.org/vm2/-/vm2-3.12.2.tgz",
-      "integrity": "sha512-LRHt4xU6eXshlZEcSZVrTehLGxRDjHvjmFPGwEp4xGpZX61QzH6Xm9wK2nU7XAp36V1w2xILAL1LwxVkgD1Ipw==",
+      "version": "3.11.6",
+      "resolved": "https://registry.npmjs.org/vm2/-/vm2-3.11.6.tgz",
+      "integrity": "sha512-35hVTcKieg7jJMntHhgWT5c2a1J2vmpXm66Xs1Z8ayHOJTj8rzIlXKzba3nO1Om/sonmnkjlAOMt9p8lYJXsWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/test-project/package.json b/test-project/package.json
index 94b42e3..4e1b1ed 100644
--- a/test-project/package.json
+++ b/test-project/package.json
@@ -7,8 +7,5 @@
   },
   "devDependencies": {
     "@dataform/cli": "3.0.71"
-  },
-  "overrides": {
-    "vm2": "^3.11.7"
   }
 }