From 4215dbecbbdedf7f90742cd69443307ea31fc2b4 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 27 Jul 2026 17:19:27 +0000
Subject: [PATCH] fix: CVE-2026-13149 security vulnerability

Automated dependency upgrade by OrbisAI Security
---
 package-lock.json | 23 +++++++++++++++++++++++
 package.json      |  1 +
 2 files changed, 24 insertions(+)

diff --git a/package-lock.json b/package-lock.json
index e60853ab..7c8bbea0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,6 +11,7 @@
 				"packages/*"
 			],
 			"dependencies": {
+				"brace-expansion": "^1.1.16",
 				"core-js": "^3.48.0",
 				"libass-wasm": "^4.1.0",
 				"whatwg-fetch": "^3.6.20"
@@ -45653,6 +45654,12 @@
 				"fd-slicer": "~1.1.0"
 			}
 		},
+		"node_modules/balanced-match": {
+			"version": "1.0.2",
+			"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+			"integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+			"license": "MIT"
+		},
 		"node_modules/baseline-browser-mapping": {
 			"version": "2.9.19",
 			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
@@ -45663,12 +45670,28 @@
 				"baseline-browser-mapping": "dist/cli.js"
 			}
 		},
+		"node_modules/brace-expansion": {
+			"version": "1.1.16",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+			"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+			"license": "MIT",
+			"dependencies": {
+				"balanced-match": "^1.0.0",
+				"concat-map": "0.0.1"
+			}
+		},
 		"node_modules/classnames": {
 			"version": "2.5.1",
 			"resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
 			"integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
 			"license": "MIT"
 		},
+		"node_modules/concat-map": {
+			"version": "0.0.1",
+			"resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+			"integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+			"license": "MIT"
+		},
 		"node_modules/core-js": {
 			"version": "3.48.0",
 			"resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
diff --git a/package.json b/package.json
index acc8726e..8f9a6af9 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
 		"eslint-config-enact-proxy": "^1.0.7"
 	},
 	"dependencies": {
+		"brace-expansion": "^1.1.16",
 		"core-js": "^3.48.0",
 		"libass-wasm": "^4.1.0",
 		"whatwg-fetch": "^3.6.20"