chore(security): override brace-expansion vulnerable ranges (GHSA-3jxr-9vmj-r5cp)#34421
Queued
Alyar666 wants to merge 1 commit into
Queued
chore(security): override brace-expansion vulnerable ranges (GHSA-3jxr-9vmj-r5cp)#34421Alyar666 wants to merge 1 commit into
Alyar666 wants to merge 1 commit into
Conversation
…r-9vmj-r5cp) Fixes Dependabot alert DevExpress#702: DoS via exponential-time expansion of consecutive non-expanding {} groups (CVE-2026-13149). Also covers the 1.x line (<1.1.16), which is vulnerable per the same advisory but not yet flagged: 1.1.14 -> 1.1.16, 5.0.6 -> 5.0.7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the pnpm workspace overrides and lockfile to remediate the brace-expansion DoS vulnerability (GHSA-3jxr-9vmj-r5cp / CVE-2026-13149) by forcing patched versions across the advisory’s affected semver ranges, addressing the Dependabot alert in the root toolchain dependency graph.
Changes:
- Widened
brace-expansionoverride ranges to fully cover the advisory windows and point to patched targets (^1.1.16,^5.0.7). - Updated the lockfile to resolve
brace-expansionto patched versions (1.1.16,5.0.7) and updated dependent snapshots (e.g.,minimatch).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Expands brace-expansion override ranges and pins to patched versions per advisory. |
| pnpm-lock.yaml | Updates resolved brace-expansion versions and dependent snapshots to match the new overrides. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
bit-byte0
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.