From af031ea51b35aab59a79e9c5a8626ba6a32da545 Mon Sep 17 00:00:00 2001 From: Clay Good Date: Sat, 3 Oct 2026 13:35:50 -0500 Subject: [PATCH] fix(deps): bump brace-expansion to 1.1.21 and 5.0.12 Closes Dependabot alerts #27 and #28 (quadratic-time `{a},b}` expansion, CPU denial of service). Both copies are dev-only, reached through eslint's and typescript-estree's minimatch, and both bumps are in range for their parents, so only the lockfile changes. Receipts for the three scenarios that pin package-lock.json are refreshed. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 12 ++++++------ scripts/quality-dependencies.json | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index cec28d39..cd503e04 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3177,9 +3177,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { @@ -3510,9 +3510,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/scripts/quality-dependencies.json b/scripts/quality-dependencies.json index 60aa531b..7509d53a 100644 --- a/scripts/quality-dependencies.json +++ b/scripts/quality-dependencies.json @@ -12,7 +12,7 @@ }, { "path": "package-lock.json", - "sha256": "ff842b09500ea416f43f836bf6b0485eee52d2c539cfa748e8587ee9ee93422f" + "sha256": "f2d420612814958d2ef72685e86ddc87eb8c82afdbd119eecf3ba37db14c42b0" }, { "path": "src/modules/anesthesia/catalog/scenario-completion.ts", @@ -221,7 +221,7 @@ }, { "path": "package-lock.json", - "sha256": "ff842b09500ea416f43f836bf6b0485eee52d2c539cfa748e8587ee9ee93422f" + "sha256": "f2d420612814958d2ef72685e86ddc87eb8c82afdbd119eecf3ba37db14c42b0" }, { "path": "src/modules/anesthesia/catalog/scenario-completion.ts", @@ -486,7 +486,7 @@ }, { "path": "package-lock.json", - "sha256": "ff842b09500ea416f43f836bf6b0485eee52d2c539cfa748e8587ee9ee93422f" + "sha256": "f2d420612814958d2ef72685e86ddc87eb8c82afdbd119eecf3ba37db14c42b0" }, { "path": "src/modules/anesthesia/catalog/scenario-completion.ts",