Skip to content

chore(deps): bump brace-expansion and eslint - #50

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-5eeac475f5
Closed

chore(deps): bump brace-expansion and eslint#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-5eeac475f5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps brace-expansion to 5.0.7 and updates ancestor dependency eslint. These dependencies need to be updated together.

Updates brace-expansion from 5.0.6 to 5.0.7

Commits

Updates eslint from 9.39.4 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
  • 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
  • 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
  • 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

  • 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
  • 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
  • 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
  • b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
  • e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
  • a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
  • d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
  • 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
  • a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
  • 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

  • c30d808 docs: Update README (GitHub Actions Bot)
  • 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
  • 04174cb docs: Update README (GitHub Actions Bot)
  • 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
  • 9d42fef docs: Update README (GitHub Actions Bot)
  • b230159 docs: Update README (GitHub Actions Bot)
  • 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

  • 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
  • 81a4774 chore: updates for v9.39.5 release (Jenkins)
  • 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
  • 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
  • 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
  • 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
  • 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
  • e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
  • 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
  • 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
  • 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
  • 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
  • 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
  • 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
  • a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
  • 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

  • b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits
  • fabd99b 10.7.0
  • 37c5e75 Build: changelog update for 10.7.0
  • 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
  • 81a4774 chore: updates for v9.39.5 release
  • 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
  • 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
  • c30d808 docs: Update README
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
  • 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade eslint to 10.7.0 and bump brace-expansion to 5.0.7 to keep the linting toolchain current and compatible with the latest minimatch.

  • Dependencies

    • eslint: 9.39.4 → 10.7.0
    • brace-expansion: 5.0.6 → 5.0.7 (via minimatch)

  • Migration

    • Running eslint now requires Node 20.19+ (per upstream engines).

Written for commit cffe88f. Summary will update on new commits.

Review in cubic

@dependabot
chore(deps): bump brace-expansion and eslint
cffe88f 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) to 5.0.7 and updates ancestor dependency [eslint](https://github.com/eslint/eslint). These dependencies need to be updated together.


Updates `brace-expansion` from 5.0.6 to 5.0.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.6...v5.0.7)

Updates `eslint` from 9.39.4 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v10.7.0)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
- dependency-name: eslint
  dependency-version: 10.7.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@changeset-bot

changeset-bot Bot commented Jul 21, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: cffe88f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Jul 21, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedeslint@​9.39.4 ⏵ 10.7.097 +110010095100

View full report

cursor[bot]
cursor Bot approved these changes Jul 21, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: medium. Approved — dependabot dev-dependency bump (eslint 9→10, brace-expansion patch) with limited blast radius. Cursor Bugbot was not present; no reviewers assigned.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Router and Approver

@yakimoto yakimoto mentioned this pull request Jul 28, 2026
Open
@yakimoto

yakimoto commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Superseded by #65, which is this PR plus four more lines. Please merge that instead.

The approach here is right and I want to be explicit about that, because I'd previously concluded this repo was unfixable (wave-av/claude-workstation#562). main carries two trees, and the root one — minimatch@3.1.5 + brace-expansion@1.1.15 — cannot take a patched brace-expansion at all: minimatch@3 calls require('brace-expansion') as a function, every patched release exports an object, and forcing it produces TypeError: expand is not a function while npm audit reports clean (claude-workstation#554).

This PR sidesteps that entirely by upgrading the consumer instead of overriding the child — bumping eslint moves @eslint/config-array to minimatch: ^10.2.4 and drops @eslint/eslintrc, which were the two things pinning minimatch@3. Verified on this branch's head:

node_modules/brace-expansion -> 5.0.7
node_modules/minimatch       -> 10.2.5
any minimatch@3? False

The trap is gone. That's the hard part, and it's done here.

The one gap: 5.0.7 is still vulnerable. A second advisory — GHSA-mh99-v99m-4gvg, range <= 5.0.7, patched in 5.0.8 — landed after the one that opened this PR, and 5.0.7 sits inside it.

brace-expansion total high
main 1.1.15 3 2
this PR 5.0.7 2 1 — still flagged
#65 5.0.8 1 0

#65 branches from this commit and runs npm update brace-expansion --package-lock-only on top, so nothing here is lost. It also carries the verification this PR couldn't get (CI is down org-wide on the billing lock): lint clean, type-check clean, build success, and a direct minimatch exercise proving the object-export change doesn't break the caller.

Worth noting for whoever reviews: the eslint bump here also clears the js-yaml HIGH as a side effect, because @eslint/eslintrc was what pulled js-yaml@4.2.0 in. That makes #53 redundant too.

@yakimoto yakimoto mentioned this pull request Jul 28, 2026
Closed
@dependabot @github

dependabot Bot commented on behalf of github Aug 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-5eeac475f5 branch August 2, 2026 00:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yakimoto