From 6b4f9124c209bd0670d606f09576db14abf41110 Mon Sep 17 00:00:00 2001 From: Patrick Lewis Date: Wed, 12 Aug 2026 09:47:04 -0400 Subject: [PATCH] fix(deps): patch brace-expansion 2.x and 5.x DoS vulnerabilities Both installed major lines of the transitive brace-expansion dependency were vulnerable to DoS via exponential-time expansion of consecutive non-expanding {} groups: brace-expansion 2.0.2 -> 2.1.4 (patched in 2.1.2) brace-expansion 5.0.3 -> 5.0.9 (patched in 5.0.7) The already-present 1.1.18 resolution is outside both vulnerable ranges and is unchanged. Resolves Dependabot alerts: https://github.com/instrumentl/stimulus-sortable/security/dependabot/90 https://github.com/instrumentl/stimulus-sortable/security/dependabot/89 --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index 0352db2..4e70765 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3265,20 +3265,20 @@ __metadata: linkType: hard "brace-expansion@npm:^2.0.2": - version: 2.0.2 - resolution: "brace-expansion@npm:2.0.2" + version: 2.1.4 + resolution: "brace-expansion@npm:2.1.4" dependencies: balanced-match: "npm:^1.0.0" - checksum: 10c0/6d117a4c793488af86b83172deb6af143e94c17bc53b0b3cec259733923b4ca84679d506ac261f4ba3c7ed37c46018e2ff442f9ce453af8643ecd64f4a54e6cf + checksum: 10c0/6c0a0e2573eac1dc565b52b1e1bfbeba39bf1830d106ebbc61ff1eaefcf610e9111cd3baa091addd18e33292135c99e019d3184d966389d85dc958fdcdc1449f languageName: node linkType: hard "brace-expansion@npm:^5.0.2": - version: 5.0.3 - resolution: "brace-expansion@npm:5.0.3" + version: 5.0.9 + resolution: "brace-expansion@npm:5.0.9" dependencies: balanced-match: "npm:^4.0.2" - checksum: 10c0/e474d300e581ec56851b3863ff1cf18573170c6d06deb199ccbd03b2119c36975f6ce2abc7b770f5bebddc1ab022661a9fea9b4d56f33315d7bef54d8793869e + checksum: 10c0/3dea38884a1c3c8b1c9c44a7402a0c76fca460f70cffb3127242b0b4cbf4472019e022ade021eec44838ff19f1dac2625dfd11dd459d7e1e055b0698a8d52fec languageName: node linkType: hard