From 55afc4cbf3bf8fe42267204eb81b17352f2d42d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sat, 28 Mar 2026 07:49:37 +0100 Subject: [PATCH] Fix Dependabot alerts: brace-expansion and path-to-regexp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Override brace-expansion >=4.0.0 <5.0.5 → 5.0.5 (process hang via zero-step sequences) - Override path-to-regexp <0.1.13 → 0.1.13 (ReDoS via Express transitive dep) - Dismissed esbuild alert #1 (already on 0.25.12+, alert for <=0.24.2) Co-Authored-By: Claude Opus 4.6 (1M context) --- package.json | 4 +++- pnpm-lock.yaml | 18 ++++++++++-------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index 0624e3e..b2956db 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,9 @@ }, "pnpm": { "overrides": { - "picomatch@>=4.0.0 <4.0.4": "4.0.4" + "picomatch@>=4.0.0 <4.0.4": "4.0.4", + "brace-expansion@>=4.0.0 <5.0.5": "5.0.5", + "path-to-regexp@<0.1.13": "0.1.13" }, "onlyBuiltDependencies": ["@sentry/cli", "esbuild"] }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d19e0cb..7497ab4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -51,6 +51,8 @@ catalogs: overrides: picomatch@>=4.0.0 <4.0.4: 4.0.4 + brace-expansion@>=4.0.0 <5.0.5: 5.0.5 + path-to-regexp@<0.1.13: 0.1.13 importers: @@ -2171,8 +2173,8 @@ packages: boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} - brace-expansion@5.0.4: - resolution: {integrity: sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==} + brace-expansion@5.0.5: + resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} engines: {node: 18 || 20 || >=22} browserslist@4.28.1: @@ -3203,8 +3205,8 @@ packages: resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} engines: {node: 18 || 20 || >=22} - path-to-regexp@0.1.12: - resolution: {integrity: sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==} + path-to-regexp@0.1.13: + resolution: {integrity: sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==} pathe@1.1.2: resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==} @@ -5723,7 +5725,7 @@ snapshots: boolbase@1.0.0: {} - brace-expansion@5.0.4: + brace-expansion@5.0.5: dependencies: balanced-match: 4.0.4 @@ -6129,7 +6131,7 @@ snapshots: methods: 1.1.2 on-finished: 2.4.1 parseurl: 1.3.3 - path-to-regexp: 0.1.12 + path-to-regexp: 0.1.13 proxy-addr: 2.0.7 qs: 6.14.2 range-parser: 1.2.1 @@ -6496,7 +6498,7 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.4 + brace-expansion: 5.0.5 minimist@1.2.8: {} @@ -6592,7 +6594,7 @@ snapshots: lru-cache: 11.2.7 minipass: 7.1.3 - path-to-regexp@0.1.12: {} + path-to-regexp@0.1.13: {} pathe@1.1.2: {}