From 859839082c89f912b346b11a42acfc0576268314 Mon Sep 17 00:00:00 2001
From: Anso <dev@saelix.com>
Date: Mon, 20 Jul 2026 19:16:32 -0400
Subject: [PATCH] fix: pin brace-expansion to a patched version in both
 packages (#1658)

npm audit was failing CI with a high-severity DoS advisory
(GHSA-3jxr-9vmj-r5cp, plus GHSA-jxxr-4gwj-5jf2 on the frontend) for
brace-expansion, pulled in transitively through eslint -> minimatch.
It is a lint-only dev dependency, never bundled into the runtime
image, but the audit gate blocks on it regardless.

Pins it via overrides instead of accepting the wider dependency bump
npm audit fix proposes, since minimatch already declares a compatible
range for the patched version.
---
 backend/package-lock.json  | 6 +++---
 backend/package.json       | 3 +++
 frontend/package-lock.json | 6 +++---
 frontend/package.json      | 3 ++-
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/backend/package-lock.json b/backend/package-lock.json
index 07c403a9..4e74aa99 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -2487,9 +2487,9 @@
       "optional": true
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/backend/package.json b/backend/package.json
index 99641897..bdb61960 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -28,6 +28,9 @@
   "engines": {
     "node": ">=26.0.0"
   },
+  "overrides": {
+    "brace-expansion": "^5.0.7"
+  },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/bcrypt": "^6.0.0",
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b3c42507..6ce1c1de 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -4000,9 +4000,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 2b5d5809..e25e1c0c 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -64,7 +64,8 @@
   },
   "overrides": {
     "dompurify": "^3.4.11",
-    "@babel/core": "^7.29.6"
+    "@babel/core": "^7.29.6",
+    "brace-expansion": "^5.0.7"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",