From ad7f6cb07f86142ab27873e03f5705d7b23dac86 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 7 Aug 2026 12:37:01 -0500 Subject: [PATCH] fix multiple CVEs by updating brace-expansion to patched versions Signed-off-by: Stephane Bouchet --- code/build/npm/gyp/package-lock.json | 6 +-- code/build/npm/gyp/package.json | 3 +- code/build/package-lock.json | 14 +++--- code/build/package.json | 5 +- code/extensions/che-api/package-lock.json | 6 +-- code/extensions/che-api/package.json | 3 +- code/extensions/che-port/package-lock.json | 6 +-- code/extensions/che-port/package.json | 3 +- code/extensions/che-remote/package-lock.json | 7 +-- code/extensions/che-remote/package.json | 3 +- .../che-resource-monitor/package-lock.json | 6 +-- .../che-resource-monitor/package.json | 3 +- .../copilot/chat-lib/package-lock.json | 41 +++++++++------ code/extensions/copilot/chat-lib/package.json | 3 +- code/extensions/copilot/package-lock.json | 32 ++++++------ code/extensions/copilot/package.json | 4 +- .../css-language-features/package-lock.json | 8 +-- .../css-language-features/package.json | 2 +- .../html-language-features/package-lock.json | 8 +-- .../html-language-features/package.json | 2 +- .../json-language-features/package-lock.json | 8 +-- .../json-language-features/package.json | 2 +- .../package-lock.json | 6 +-- .../markdown-language-features/package.json | 3 ++ code/extensions/npm/package-lock.json | 6 +-- code/extensions/npm/package.json | 3 ++ code/package-lock.json | 50 +++++++++---------- code/package.json | 4 +- code/test/automation/package-lock.json | 6 +-- code/test/automation/package.json | 3 +- .../integration/browser/package-lock.json | 6 +-- code/test/integration/browser/package.json | 3 ++ code/test/sanity/package-lock.json | 6 +-- code/test/sanity/package.json | 3 +- launcher/package-lock.json | 7 +-- launcher/package.json | 3 +- 36 files changed, 160 insertions(+), 124 deletions(-) diff --git a/code/build/npm/gyp/package-lock.json b/code/build/npm/gyp/package-lock.json index 7533caf0666f..38c46d7b0451 100644 --- a/code/build/npm/gyp/package-lock.json +++ b/code/build/npm/gyp/package-lock.json @@ -138,9 +138,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/build/npm/gyp/package.json b/code/build/npm/gyp/package.json index 7276ab0f3964..450b6733340e 100644 --- a/code/build/npm/gyp/package.json +++ b/code/build/npm/gyp/package.json @@ -7,7 +7,8 @@ "node-gyp": "^11.2.0" }, "overrides": { - "ip-address": "^10.2.0" + "ip-address": "^10.2.0", + "brace-expansion@2": "^2.1.4" }, "scripts": {} } diff --git a/code/build/package-lock.json b/code/build/package-lock.json index 0502d3c5ebaf..fc53efb9948a 100644 --- a/code/build/package-lock.json +++ b/code/build/package-lock.json @@ -2546,16 +2546,16 @@ "license": "BSD-2-Clause" }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/brace-expansion/node_modules/balanced-match": { @@ -6762,9 +6762,9 @@ } }, "node_modules/vscode-universal-bundler/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/build/package.json b/code/build/package.json index 61623814e8c5..5bbff1232b00 100644 --- a/code/build/package.json +++ b/code/build/package.json @@ -83,9 +83,10 @@ "lodash": "^4.18.1", "qs": "6.15.2", "@vscode/vsce": { - "brace-expansion": "5.0.7", + "brace-expansion": "5.0.9", "form-data": "^4.0.6" }, - "form-data@4": "^4.0.6" + "form-data@4": "^4.0.6", + "brace-expansion@2": "^2.1.4" } } diff --git a/code/extensions/che-api/package-lock.json b/code/extensions/che-api/package-lock.json index e23bfaa05eaa..6aa0d4314334 100644 --- a/code/extensions/che-api/package-lock.json +++ b/code/extensions/che-api/package-lock.json @@ -1566,9 +1566,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-api/package.json b/code/extensions/che-api/package.json index 1fa470ae9283..c5d124e8c9d7 100644 --- a/code/extensions/che-api/package.json +++ b/code/extensions/che-api/package.json @@ -68,7 +68,8 @@ }, "axios": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/che-port/package-lock.json b/code/extensions/che-port/package-lock.json index f1c08035f98b..e000ea912c8c 100644 --- a/code/extensions/che-port/package-lock.json +++ b/code/extensions/che-port/package-lock.json @@ -1302,9 +1302,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-port/package.json b/code/extensions/che-port/package.json index d4231d8de533..0f8d29c7fbde 100644 --- a/code/extensions/che-port/package.json +++ b/code/extensions/che-port/package.json @@ -52,7 +52,8 @@ "form-data@2": "^2.5.6" }, "minimatch": "^3.1.5", - "handlebars": "4.7.9" + "handlebars": "4.7.9", + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/che-remote/package-lock.json b/code/extensions/che-remote/package-lock.json index b416d2de5768..c1633ee5f369 100644 --- a/code/extensions/che-remote/package-lock.json +++ b/code/extensions/che-remote/package-lock.json @@ -1697,10 +1697,11 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" diff --git a/code/extensions/che-remote/package.json b/code/extensions/che-remote/package.json index ab71b1ceda7c..5125fbc03c52 100644 --- a/code/extensions/che-remote/package.json +++ b/code/extensions/che-remote/package.json @@ -65,7 +65,8 @@ "flatted": "^3.4.2", "axios": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/che-resource-monitor/package-lock.json b/code/extensions/che-resource-monitor/package-lock.json index 20404f96c8ec..e0e18dc8d182 100644 --- a/code/extensions/che-resource-monitor/package-lock.json +++ b/code/extensions/che-resource-monitor/package-lock.json @@ -1553,9 +1553,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-resource-monitor/package.json b/code/extensions/che-resource-monitor/package.json index 49c5d83e82ed..348e76c8ec0e 100644 --- a/code/extensions/che-resource-monitor/package.json +++ b/code/extensions/che-resource-monitor/package.json @@ -59,7 +59,8 @@ }, "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/copilot/chat-lib/package-lock.json b/code/extensions/copilot/chat-lib/package-lock.json index 75a527bb1fbc..5ba9eefa0b4f 100644 --- a/code/extensions/copilot/chat-lib/package-lock.json +++ b/code/extensions/copilot/chat-lib/package-lock.json @@ -1637,17 +1637,6 @@ "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", "dev": true }, - "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/call-bind": { "version": "1.0.8", "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz", @@ -1796,6 +1785,17 @@ "copyup": "copyfiles" } }, + "node_modules/copyfiles/node_modules/brace-expansion": { + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/copyfiles/node_modules/cliui": { "version": "7.0.4", "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz", @@ -3532,16 +3532,16 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/mkdirp": { @@ -3702,6 +3702,17 @@ "node": ">=4" } }, + "node_modules/npm-run-all/node_modules/brace-expansion": { + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/npm-run-all/node_modules/chalk": { "version": "2.4.2", "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz", diff --git a/code/extensions/copilot/chat-lib/package.json b/code/extensions/copilot/chat-lib/package.json index f397c5e9163c..13966ae443bb 100644 --- a/code/extensions/copilot/chat-lib/package.json +++ b/code/extensions/copilot/chat-lib/package.json @@ -71,8 +71,9 @@ }, "overrides": { "shell-quote": "^1.8.4", + "brace-expansion@1": "^1.1.18", "minimatch@10": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } } } diff --git a/code/extensions/copilot/package-lock.json b/code/extensions/copilot/package-lock.json index 3a3fc30200b7..c8585eb21221 100644 --- a/code/extensions/copilot/package-lock.json +++ b/code/extensions/copilot/package-lock.json @@ -6497,9 +6497,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -7011,9 +7011,9 @@ } }, "node_modules/@vscode/test-cli/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -8097,9 +8097,9 @@ "license": "BSD-2-Clause" }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -12561,15 +12561,15 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimist": { @@ -12734,9 +12734,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/copilot/package.json b/code/extensions/copilot/package.json index 497ff5f3fac5..37b589492f67 100644 --- a/code/extensions/copilot/package.json +++ b/code/extensions/copilot/package.json @@ -7252,7 +7252,9 @@ "qs": "6.15.2", "ip-address": "^10.2.0", "ws": "^8.21.0", - "brace-expansion@5": "5.0.7", + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", + "brace-expansion@5": "5.0.9", "form-data@4": "^4.0.6", "@vscode/vsce": { "form-data": "^4.0.6" diff --git a/code/extensions/css-language-features/package-lock.json b/code/extensions/css-language-features/package-lock.json index aa092c374939..b48341215618 100644 --- a/code/extensions/css-language-features/package-lock.json +++ b/code/extensions/css-language-features/package-lock.json @@ -39,15 +39,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimatch": { diff --git a/code/extensions/css-language-features/package.json b/code/extensions/css-language-features/package.json index cd3b5ca70563..b2c61ffd0983 100644 --- a/code/extensions/css-language-features/package.json +++ b/code/extensions/css-language-features/package.json @@ -1001,7 +1001,7 @@ }, "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } }, "repository": { diff --git a/code/extensions/html-language-features/package-lock.json b/code/extensions/html-language-features/package-lock.json index b0bf43e5f022..bb701c92d8d4 100644 --- a/code/extensions/html-language-features/package-lock.json +++ b/code/extensions/html-language-features/package-lock.json @@ -188,15 +188,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimatch": { diff --git a/code/extensions/html-language-features/package.json b/code/extensions/html-language-features/package.json index e7d114f153f9..83786ffae0fc 100644 --- a/code/extensions/html-language-features/package.json +++ b/code/extensions/html-language-features/package.json @@ -273,7 +273,7 @@ }, "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } }, "repository": { diff --git a/code/extensions/json-language-features/package-lock.json b/code/extensions/json-language-features/package-lock.json index 9df45bbbcd0f..5ec1ee4da348 100644 --- a/code/extensions/json-language-features/package-lock.json +++ b/code/extensions/json-language-features/package-lock.json @@ -188,15 +188,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimatch": { diff --git a/code/extensions/json-language-features/package.json b/code/extensions/json-language-features/package.json index d98dbb294de8..40e78aace72f 100644 --- a/code/extensions/json-language-features/package.json +++ b/code/extensions/json-language-features/package.json @@ -197,7 +197,7 @@ }, "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } }, "repository": { diff --git a/code/extensions/markdown-language-features/package-lock.json b/code/extensions/markdown-language-features/package-lock.json index 13bdb2e042cc..39aeb3014253 100644 --- a/code/extensions/markdown-language-features/package-lock.json +++ b/code/extensions/markdown-language-features/package-lock.json @@ -661,9 +661,9 @@ "license": "ISC" }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", diff --git a/code/extensions/markdown-language-features/package.json b/code/extensions/markdown-language-features/package.json index 45c08f7dc560..72e1aa119ef6 100644 --- a/code/extensions/markdown-language-features/package.json +++ b/code/extensions/markdown-language-features/package.json @@ -927,6 +927,9 @@ "vscode-languageserver-types": "^3.17.2", "vscode-markdown-languageservice": "0.5.0" }, + "overrides": { + "brace-expansion@1": "^1.1.18" + }, "repository": { "type": "git", "url": "https://github.com/microsoft/vscode.git" diff --git a/code/extensions/npm/package-lock.json b/code/extensions/npm/package-lock.json index e530dc602695..9375cebc44a6 100644 --- a/code/extensions/npm/package-lock.json +++ b/code/extensions/npm/package-lock.json @@ -63,9 +63,9 @@ "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c= sha512-9Y0g0Q8rmSt+H33DfKv7FOc3v+iRI+o1lbzt8jGcIosYW37IIW/2XVYq5NPdmaD5NQ59Nk26Kl/vZbwW9Fr8vg==" }, "node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" diff --git a/code/extensions/npm/package.json b/code/extensions/npm/package.json index 6964d702e1d9..4326944e9de0 100644 --- a/code/extensions/npm/package.json +++ b/code/extensions/npm/package.json @@ -384,6 +384,9 @@ } ] }, + "overrides": { + "brace-expansion@2": "^2.1.4" + }, "repository": { "type": "git", "url": "https://github.com/microsoft/vscode.git" diff --git a/code/package-lock.json b/code/package-lock.json index d93adf0aa529..4bb6ac57de0a 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -2889,9 +2889,9 @@ } }, "node_modules/@ts-morph/common/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -3410,9 +3410,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -3812,9 +3812,9 @@ } }, "node_modules/@vscode/l10n-dev/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -4077,9 +4077,9 @@ } }, "node_modules/@vscode/test-cli/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -5523,9 +5523,9 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -13276,9 +13276,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -17149,16 +17149,16 @@ } }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/test-exclude/node_modules/glob": { @@ -17191,9 +17191,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/package.json b/code/package.json index 4a2d86c46f1a..d02cdb2fa5b5 100644 --- a/code/package.json +++ b/code/package.json @@ -292,8 +292,10 @@ "shell-quote": "^1.8.4", "qs": "6.15.2", "ip-address": "^10.2.0", + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", "test-exclude": { - "brace-expansion@5": "5.0.7" + "brace-expansion@5": "5.0.9" }, "axios": { "form-data": "^4.0.6" diff --git a/code/test/automation/package-lock.json b/code/test/automation/package-lock.json index 7865e34b97b9..a79b53b28e35 100644 --- a/code/test/automation/package-lock.json +++ b/code/test/automation/package-lock.json @@ -114,9 +114,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/test/automation/package.json b/code/test/automation/package.json index f3c3fd610209..8cdabb2c03e0 100644 --- a/code/test/automation/package.json +++ b/code/test/automation/package.json @@ -33,6 +33,7 @@ "npm-run-all2": "^8.0.4" }, "overrides": { - "shell-quote": "^1.8.4" + "shell-quote": "^1.8.4", + "brace-expansion@1": "^1.1.18" } } diff --git a/code/test/integration/browser/package-lock.json b/code/test/integration/browser/package-lock.json index 1f44058fcea8..e899c83cc938 100644 --- a/code/test/integration/browser/package-lock.json +++ b/code/test/integration/browser/package-lock.json @@ -74,9 +74,9 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/test/integration/browser/package.json b/code/test/integration/browser/package.json index b48e2564bf9c..55350c890067 100644 --- a/code/test/integration/browser/package.json +++ b/code/test/integration/browser/package.json @@ -14,5 +14,8 @@ "tmp": "0.2.6", "tree-kill": "1.2.2", "vscode-uri": "^3.0.2" + }, + "overrides": { + "brace-expansion@1": "^1.1.18" } } diff --git a/code/test/sanity/package-lock.json b/code/test/sanity/package-lock.json index 378ccd82d4d4..574da98c8e3b 100644 --- a/code/test/sanity/package-lock.json +++ b/code/test/sanity/package-lock.json @@ -113,9 +113,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz", - "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" diff --git a/code/test/sanity/package.json b/code/test/sanity/package.json index 6e67f1d1663f..fda50b7b51c1 100644 --- a/code/test/sanity/package.json +++ b/code/test/sanity/package.json @@ -22,6 +22,7 @@ "typescript": "^6.0.0-dev.20251110" }, "overrides": { - "serialize-javascript": "^7.0.3" + "serialize-javascript": "^7.0.3", + "brace-expansion@2": "^2.1.4" } } diff --git a/launcher/package-lock.json b/launcher/package-lock.json index 8344c064b5e8..4dca0b3d7cab 100644 --- a/launcher/package-lock.json +++ b/launcher/package-lock.json @@ -1820,10 +1820,11 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" diff --git a/launcher/package.json b/launcher/package.json index 03eb2dc6a0c2..cfc9184a7fdf 100644 --- a/launcher/package.json +++ b/launcher/package.json @@ -59,7 +59,8 @@ "ws": "^8.21.0", "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "jest": { "collectCoverage": true,