From 26ebf990fb821c4c63aac38dabcae81e7a45dc58 Mon Sep 17 00:00:00 2001 From: Steve Fackley Date: Fri, 31 Jul 2026 19:27:54 -0400 Subject: [PATCH 1/2] fix(deps): bump brace-expansion override floors to patched versions npm audit gate was failing on GHSA-mh99-v99m-4gvg: the existing brace-expansion@1 override floor (^1.1.16) sat below the patched 1.1.17, so every resolution chain through eslint/minimatch stayed vulnerable. Bump @1 to ^1.1.17 and @2 to ^2.1.3; audit now reports 0 vulnerabilities. --- src/StackAlchemist.Web/package-lock.json | 24 ++++++++++++------------ src/StackAlchemist.Web/package.json | 4 ++-- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/src/StackAlchemist.Web/package-lock.json b/src/StackAlchemist.Web/package-lock.json index d43e629..5891f89 100644 --- a/src/StackAlchemist.Web/package-lock.json +++ b/src/StackAlchemist.Web/package-lock.json @@ -643,9 +643,9 @@ "license": "MIT" }, "node_modules/@eslint/config-array/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -724,9 +724,9 @@ "license": "MIT" }, "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -5138,9 +5138,9 @@ "license": "MIT" }, "node_modules/eslint-config-next/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -5411,9 +5411,9 @@ "license": "MIT" }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/src/StackAlchemist.Web/package.json b/src/StackAlchemist.Web/package.json index 8b96a15..21a6e5e 100644 --- a/src/StackAlchemist.Web/package.json +++ b/src/StackAlchemist.Web/package.json @@ -61,8 +61,8 @@ "postcss": "^8.5.18", "ws": "^8.20.1", "sharp@0": "^0.35.0", - "brace-expansion@1": "^1.1.16", - "brace-expansion@2": "^2.1.2", + "brace-expansion@1": "^1.1.17", + "brace-expansion@2": "^2.1.3", "brace-expansion@5": "^5.0.8" } } From 3ed2386a20acd01d3f8a3c041c1655c84fcf5637 Mon Sep 17 00:00:00 2001 From: Steve Fackley Date: Fri, 31 Jul 2026 19:36:34 -0400 Subject: [PATCH 2/2] chore: drop resolved GHSA-mh99-v99m-4gvg from audit allowlist brace-expansion 1.1.17 shipped upstream, so the entry's premise (no fixed 1.x release) no longer holds and the gate rightly demands its removal now that the floor bump resolves the advisory. --- src/StackAlchemist.Web/audit-allowlist.json | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/src/StackAlchemist.Web/audit-allowlist.json b/src/StackAlchemist.Web/audit-allowlist.json index cce08a1..2c5debc 100644 --- a/src/StackAlchemist.Web/audit-allowlist.json +++ b/src/StackAlchemist.Web/audit-allowlist.json @@ -9,13 +9,5 @@ "This file is not a way to silence a fixable finding. If `npm audit` can", "resolve it with an override or an upgrade, do that instead." ], - "allow": [ - { - "advisory": "GHSA-mh99-v99m-4gvg", - "package": "brace-expansion", - "scope": "dev", - "expires": "2026-10-31", - "reason": "DoS via unbounded expansion length. Patched only in brace-expansion 5.0.8 — the advisory covers the entire <=5.0.7 range, so the 1.x line has no fixed release at all. Our remaining exposure is minimatch@3.1.5, which pins brace-expansion ^1.1.7 and calls it as a bare function; brace-expansion 5 is a named-export module, so forcing it there breaks eslint at runtime. minimatch@3 reaches us only through eslint 9 and the eslint-config-next plugin set (eslint-plugin-import/jsx-a11y/react), whose latest releases still pin minimatch ^3.1.2 and cap their eslint peer at 9. `npm audit fix --force` 'resolves' this by downgrading eslint-config-next from ^16.2.10 to ^0.2.4, which is not a fix. Lint-time only, never shipped to users. Revisit when the eslint-config-next plugins move off minimatch 3." - } - ] + "allow": [] }