From afecd181232fb6edcda4a91b655b3391598f8a95 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Tue, 21 Jul 2026 15:53:28 +0200 Subject: [PATCH] fix(web): patch js-yaml and brace-expansion DoS advisories Dependabot alerts #63/#64/#65 (all high): brace-expansion exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, both the 1.x and 2.x trees) and js-yaml quadratic CPU consumption via YAML merge-key chains (GHSA-52cp-r559-cp3m). All three are transitive dev-only dependencies of the eslint toolchain (eslint -> @eslint/eslintrc -> js-yaml; eslint/typescript-estree -> minimatch -> brace-expansion) and resolve within their existing semver ranges, so only the lockfile changes. npx tsc --noEmit clean, vitest 557 passed, npm audit reports 0 vulnerabilities. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../autopilot-monitor-web/package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/Web/autopilot-monitor-web/package-lock.json b/src/Web/autopilot-monitor-web/package-lock.json index 2194eab9..4547ed5e 100644 --- a/src/Web/autopilot-monitor-web/package-lock.json +++ b/src/Web/autopilot-monitor-web/package-lock.json @@ -1976,9 +1976,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz", - "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", "dependencies": { @@ -2877,9 +2877,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { @@ -5312,9 +5312,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ {