Upgrades brace-expansion (npm) from 1.1.11, 2.0.1 to 2.1.7, which fixes these known vulnerabilities:
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-3jxr-9vmj-r5cp | high | 1.1.11 | 1.1.16 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | 1.1.11 | 1.1.19 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-f886-m6hf-6m8v | medium | 1.1.11 | 1.1.13 | brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
| GHSA-mh99-v99m-4gvg | high | 1.1.11 | 1.1.17 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-q2hr-2g5m-vwhr | medium | 1.1.11 | 1.1.21 | brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service |
| GHSA-qhr7-859c-m2p7 | high | 1.1.11 | 1.1.20 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | 1.1.11 | 1.1.18 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-v6h2-p8h4-qcjw | low | 1.1.11 | 1.1.12 | brace-expansion Regular Expression Denial of Service vulnerability |
| GHSA-3jxr-9vmj-r5cp | high | 2.0.1 | 2.1.2 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | 2.0.1 | 2.1.5 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-f886-m6hf-6m8v | medium | 2.0.1 | 2.0.3 | brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
| GHSA-mh99-v99m-4gvg | high | 2.0.1 | 2.1.3 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-q2hr-2g5m-vwhr | medium | 2.0.1 | 2.1.7 | brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service |
| GHSA-qhr7-859c-m2p7 | high | 2.0.1 | 2.1.6 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | 2.0.1 | 2.1.4 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-v6h2-p8h4-qcjw | low | 2.0.1 | 2.0.2 | brace-expansion Regular Expression Denial of Service vulnerability |
Lockfiles changed: src/package-lock.json.
Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.
Opened by g1t's security updates. Turn them off for this project on its Security page.