From 9bce5ac7bdbcbcc889261bc93a1bfb4bd29f63bb Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Tue, 4 Aug 2026 15:10:51 +0530 Subject: [PATCH] chore(deps): raise the brace-expansion floor to 5.0.9 GHSA-rgw5-rvv9-x895 widened the affected range to <5.0.9, so the existing >=5.0.8 override stopped clearing it and the audit step in tests.yml now fails on every branch. Only the pinned floor and the resolved version move; integrity hashes are untouched. --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index ef28594b87..4f7dcfe958 100644 --- a/bun.lock +++ b/bun.lock @@ -90,7 +90,7 @@ }, }, "overrides": { - "brace-expansion": ">=5.0.8", + "brace-expansion": ">=5.0.9", "cookie": "^0.7.0", "devalue": "^5.8.1", "flatted": "^3.4.2", @@ -650,7 +650,7 @@ "binary-extensions": ["binary-extensions@2.3.0", "", {}, "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw=="], - "brace-expansion": ["brace-expansion@5.0.8", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg=="], + "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="], "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="], diff --git a/package.json b/package.json index 72c88a0eb2..c4958f63e7 100644 --- a/package.json +++ b/package.json @@ -104,7 +104,7 @@ "overrides": { "vite": "npm:rolldown-vite@latest", "minimatch": "10.2.3", - "brace-expansion": ">=5.0.8", + "brace-expansion": ">=5.0.9", "js-yaml": "^4.3.0", "immutable": "^5.1.8", "flatted": "^3.4.2",