From 652226543c27273120e03e0ee2e67a6a428bfe98 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Thu, 30 Jul 2026 21:30:49 +0800 Subject: [PATCH] build(deps): patch brace expansion denial of service --- package-lock.json | 24 +++++++++++----------- package.json | 6 +++--- tests/installed-lock-parity.test.ts | 32 +++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 15 deletions(-) diff --git a/package-lock.json b/package-lock.json index 0e4f6236a5..55d4bd097a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5252,9 +5252,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -6355,9 +6355,9 @@ } }, "node_modules/eslint-config-next/node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -10402,9 +10402,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -10588,9 +10588,9 @@ } }, "node_modules/rimraf/node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 3dea603c16..0ba3834685 100644 --- a/package.json +++ b/package.json @@ -241,9 +241,9 @@ "sharp": "0.35.3", "tmp": "^0.2.7", "uuid": "^11.1.1", - "brace-expansion@1": "^1.1.16", - "brace-expansion@2": "^2.1.2", - "brace-expansion@5": "^5.0.8", + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", + "brace-expansion@5": "^5.0.9", "exceljs": { "archiver": "^8.0.0", "unzipper": "^0.12.5" diff --git a/tests/installed-lock-parity.test.ts b/tests/installed-lock-parity.test.ts index 0aeb6f6b47..e00be5bc2f 100644 --- a/tests/installed-lock-parity.test.ts +++ b/tests/installed-lock-parity.test.ts @@ -1,10 +1,12 @@ import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; +import { createRequire } from "node:module"; import os from "node:os"; import path from "node:path"; import { afterEach, describe, expect, it } from "vitest"; import { criticalInstalledPackages, installedLockParity } from "../scripts/check-installed-lock-parity.mjs"; const temporaryRoots: string[] = []; +const requireFromTest = createRequire(import.meta.url); function fixture(lockedVersion: string, installedVersion?: string) { const root = mkdtempSync(path.join(os.tmpdir(), "installed-lock-parity-")); @@ -72,4 +74,34 @@ describe("installedLockParity", () => { ); expect(ci).toContain("run: npm run check:installed-lock-parity"); }); + + it("keeps brace-expansion on CVE-2026-14257-patched maintenance releases", () => { + const packageJson = JSON.parse(readFileSync(path.resolve("package.json"), "utf8")) as { + overrides: Record; + }; + const lock = JSON.parse(readFileSync(path.resolve("package-lock.json"), "utf8")) as { + packages: Record; + }; + const expand = requireFromTest("brace-expansion") as ( + input: string, + options?: { max?: number; maxLength?: number }, + ) => string[]; + + expect(packageJson.overrides).toMatchObject({ + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", + "brace-expansion@5": "^5.0.9", + }); + expect(lock.packages["node_modules/brace-expansion"]?.version).toBe("1.1.18"); + expect( + Object.entries(lock.packages) + .filter(([name]) => name.endsWith("node_modules/brace-expansion")) + .map(([, entry]) => entry.version), + ).toEqual(expect.arrayContaining(["1.1.18", "5.0.9"])); + + const maxLength = 40_000; + const adversarial = expand("{a,b}".repeat(100), { max: 100_000, maxLength }); + expect(adversarial.reduce((total, value) => total + value.length, 0)).toBeLessThanOrEqual(maxLength); + expect(expand("a{b,c}d")).toEqual(["abd", "acd"]); + }); });