From a24fc97778fca67cfac4cd3fc63e508ee1d29f59 Mon Sep 17 00:00:00 2001 From: Vladislav Nechakhin Date: Tue, 20 Oct 2026 11:09:26 +0100 Subject: [PATCH] fix(cli): patch missed brace-expansion dependency majors (#9360) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patch the remaining 1.x and 2.x copies covered by [GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr), which were not addressed by #9349. Regenerate both CLI fixture locks with their declared Yarn 1.22.22: 1.1.11/1.1.12 → 1.1.21 and 2.0.2 → 2.1.7, retaining 5.0.12 with no new packages or manifest changes. Verification: - Both fixtures: `yarn install --frozen-lockfile --ignore-scripts --non-interactive` and `yarn check --integrity --ignore-scripts` passed. - Local Node regression harness: 16 checks passed across all installed brace-expansion and real minimatch 3/9/10 consumers, including normal expansion/matching and advisory-shaped DoS payloads with a three-second subprocess deadline (direct 128k braces; minimatch 64k braces). - Every tracked text file scanned for brace-expansion; all five resolved lock entries are outside all four current advisory ranges. No additional repository copies found. - `git diff --check` passed; only three generated version/URL/integrity triplets changed. Lifecycle scripts and the full suite were intentionally not run. Existing peer-dependency warnings remain, including the checkpoint resolution mismatch in js-examples; dependency-graph ingestion and alert status were not refreshed or claimed resolved. ## References - [Plan](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846/plan) - [Slack thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349) Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846) · openai:gpt-6.1-sol (medium) Co-authored-by: Vladislav Nechakhin Co-authored-by: open-swe[bot] --- libs/cli/js-examples/yarn.lock | 12 ++++++------ libs/cli/js-monorepo-example/yarn.lock | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/libs/cli/js-examples/yarn.lock b/libs/cli/js-examples/yarn.lock index 6cefbdbaf..79ec13ade 100644 --- a/libs/cli/js-examples/yarn.lock +++ b/libs/cli/js-examples/yarn.lock @@ -1776,17 +1776,17 @@ baseline-browser-mapping@^2.11.12: integrity sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw== brace-expansion@^1.1.7: - version "1.1.11" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.11.tgz#3c7fcbf529d87226f3d2f52b966ff5271eb441dd" - integrity sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA== + version "1.1.21" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.21.tgz#edf4fab5c64d051aea5a8def49aba1c7522279f3" + integrity sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw== dependencies: balanced-match "^1.0.0" concat-map "0.0.1" brace-expansion@^2.0.2: - version "2.0.2" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.0.2.tgz#54fc53237a613d854c7bd37463aad17df87214e7" - integrity sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ== + version "2.1.7" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.7.tgz#14ea3836731823bb24740225ea43b941b436f9d1" + integrity sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g== dependencies: balanced-match "^1.0.0" diff --git a/libs/cli/js-monorepo-example/yarn.lock b/libs/cli/js-monorepo-example/yarn.lock index e37fad0fd..2c4af3f36 100644 --- a/libs/cli/js-monorepo-example/yarn.lock +++ b/libs/cli/js-monorepo-example/yarn.lock @@ -581,9 +581,9 @@ base64-js@^1.5.1: integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA== brace-expansion@^1.1.7: - version "1.1.12" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.12.tgz#ab9b454466e5a8cc3a187beaad580412a9c5b843" - integrity sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg== + version "1.1.21" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.21.tgz#edf4fab5c64d051aea5a8def49aba1c7522279f3" + integrity sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw== dependencies: balanced-match "^1.0.0" concat-map "0.0.1"