fix(deps): raise the brace-expansion floor to >=5.0.9 - #2501
Conversation
`pnpm audit --audit-level=high` flags brace-expansion on playground. The override was `>=5.0.7 <6`, which sits below the patched floor of two advisories: GHSA-mh99-v99m-4gvg DoS via unbounded expansion length (OOM crash) vulnerable >=4.0.0 <5.0.8 GHSA-rgw5-rvv9-x895 DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation vulnerable >=4.0.0 <5.0.9 `>=5.0.9` clears both. Dropping the `<6` ceiling is deliberate: it is what would silently re-expose this the next time the floor moves, which is exactly what happened here. Scope, stated plainly: this closes brace-expansion ONLY. `pnpm audit` still exits 1 on this branch — 18 other high findings remain across fast-uri, ip-address, next, postcss, sharp, socket.io-parser and undici. Those are pre-existing, unrelated, and not bundled in here. Same advisory class as percolator-indexer#193, though a different advisory: indexer was already at >=5.0.8 and needed the newer bypass fix, while this repo was below both floors.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pnpm override for ChangesDependency override update
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
package.jsonOops! Something went wrong! :( ESLint: 8.57.1 TypeError: Cannot read properties of undefined (reading 'Intrinsic') Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Raise the
brace-expansionoverride from>=5.0.7 <6to>=5.0.9.Why
pnpm audit --audit-level=highflags it onplayground. The old range sits belowthe patched floor of two advisories:
>=4.0.0 <5.0.8>=4.0.0 <5.0.9>=5.0.9clears both. Verified: brace-expansion no longer appears in the auditoutput on this branch.
Dropping the
<6ceiling is deliberate — an upper bound on a security floor iswhat silently re-exposes you the next time the floor moves, which is precisely
what happened here.
Scope — stated plainly, because the headline number does not change
This closes
brace-expansiononly.pnpm auditstill exits 1 on this branch:18 other high findings remain, across
fast-uri,ip-address,next,postcss,sharp,socket.io-parserandundici. They are pre-existing andunrelated; bundling them into a one-line override bump would make this
unreviewable.
Why this accumulated — worth more attention than the fix
The audit gate exists:
It lives in the
security-testsjob — one of the jobs that reports SKIPPEDon every PR, because it is gated on
packages/*, which no longer exists onplayground. That is the same #2447 pattern I hit earlier with the app suite, butthis instance is sharper: the dependency audit is among the dead jobs, so 19
high advisories accumulated with the gate that would have caught them reporting
green.
I've filed that separately rather than expanding this PR — the remaining 18 want
individual assessment, and several (
next,undici,sharp) are likely to needreal upgrades rather than overrides.
Related: percolator-indexer#193 fixes the same package in that repo, but a
different advisory — indexer was already at
>=5.0.8and needed only the newerbypass fix, whereas this repo was below both floors.
Summary by CodeRabbit
brace-expansionversion constraint to require a newer compatible release.