golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(#2765): bump brace-expansion to patched 1.1.18/5.0.9 (high-severity devDep advisory) (#2888)

Browse Source 
* fix(#2765): bump brace-expansion to patched 1.1.18/5.0.9 (high-severity devDep advisory)

npm audit fix (non-breaking) bumps the lockfile: brace-expansion 1.1.15→1.1.18
(eslint-nested via minimatch@3.x) and 5.0.6→5.0.9 (stryker-nested). Both 1.1.18 and
5.0.9 were published 2026-07-30 as the patch backports for GHSA-3jxr-9vmj-r5cp /
GHSA-mh99-v99m-4gvg (range <=5.0.7). No overrides needed (in-range bump), no major
bumps, no --force. Production (npm audit --omit=dev) unaffected (devDep only).
Add a structural test pinning the installed versions so the bump can't silently regress.

* chore(#2765): changeset fragment

* fix(#2765): correct changeset issue ref + parse patch version as number (review findings)

- changeset cited #2762 (typo) — fix to (#2765).
- test compared v.split('.')[2] as a string (false-pass for 1.1.9) — parse all segments as Number.

* chore(#2765): backfill changeset PR number (2888)

---------

Co-authored-by: Test <test@example.com>
This commit is contained in:
Tom Boucher
2026-07-30 20:12:28 -04:00
committed by GitHub
parent 4bd6fb066b
commit 54cb4145bf
3 changed files with 66 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/brave-orcas-rest.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Fixed
pr: 2888
---
**Dev-dependency `brace-expansion` bumped to patched versions (1.1.18 / 5.0.9), resolving the high-severity DoS/OOM advisories** — the lockfile now pins the 2026-07-30 patch backports reachable via eslint and stryker. A non-breaking in-range bump (no overrides, no major bumps); production `npm audit --omit=dev` is unaffected (devDependency only). (#2765)