Repository navigation
refactor: Bump brace-expansion from 1.1.11 to 1.1.21 and 2.0.1 to 2.1.7 - #227
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
Warning Review limit reachedThe included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Next included review available in 18 minutes. View limit details
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #227 +/- ##
=======================================
Coverage 95.87% 95.87%
=======================================
Files 23 23
Lines 849 849
=======================================
Hits 814 814
Misses 35 35 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Closes #222
Updates the transitive dev dependency
brace-expansioninpackage-lock.json:node_modules/brace-expansionminimatch@3.1.5(used byeslint,nyc,codecov)node_modules/glob/node_modules/brace-expansionminimatch@5.1.9(mocha>glob@8.1.0)node_modules/mocha/node_modules/brace-expansionminimatch@5.1.9(mocha)This resolves Dependabot alerts 211 and 161 (1.x line) and 200 and 159 (2.x line). The
brace-expansion@5.0.6copy bundled insidenpm(pulled in by@semantic-release/npm) can't be updated through the lock file, so alerts 162 and 215 stay open.Changes
1.x line (1.1.11 to 1.1.21):
{1..2..0}) hanging the process and exhausting memory (Backport fix for GHSA-f886-m6hf-6m8v to v1 juliangruber/brace-expansion#95, GHSA-f886-m6hf-6m8v / CVE-2026-33750)maxoption that caps the number of expansions, unbounded by default (opt-in backport of the GHSA-7h2j-956f-4vf2 mitigation from@isaacs/brace-expansion; Add opt-in { max } mitigation to v1 legacy line juliangruber/brace-expansion#103). Edge-case change in the same release: the string produced by the{a},b}rewrite is now expanded as a top-level pattern, so empty results are dropped there too, e.g.{1},}returns["1}"]instead of["1}", ""].max(Backport v5.0.6 change to v1 juliangruber/brace-expansion#111){}groups (fix: v1 backport for CVE-2026-13149 juliangruber/brace-expansion#122, GHSA-3jxr-9vmj-r5cp / CVE-2026-13149)maxnow defaults to 100,000 results, a newmaxLengthoption (default 4,000,000 characters) bounds the total output, and chained groups are expanded iteratively (fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#129, GHSA-mh99-v99m-4gvg / CVE-2026-14257)parseCommaParts(GHSA-6j4f-fj2g-mc7p / CVE-2026-102276)maxDepthoption (default 1000) (GHSA-qhr7-859c-m2p7 / CVE-2026-102278){a},b}rewrite, with a newmaxRewritesoption (default 1000) (GHSA-q2hr-2g5m-vwhr / CVE-2026-102277)2.x line (2.0.1 to 2.1.7), same fixes backported:
maxoption, unbounded by default (Add opt-in { max } mitigation to v2 legacy line juliangruber/brace-expansion#100), with the same{a},b}edge-case change as 1.1.14{}groups fix (fix: v2 backport for CVE-2026-13149 juliangruber/brace-expansion#123, GHSA-3jxr-9vmj-r5cp / CVE-2026-13149)maxdefaults to 100,000 andmaxLengthto 4,000,000 (fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#130, GHSA-mh99-v99m-4gvg / CVE-2026-14257)parseCommaPartsrecursion fix (GHSA-6j4f-fj2g-mc7p / CVE-2026-102276)maxDepthoption (GHSA-qhr7-859c-m2p7 / CVE-2026-102278){a},b}rewrite fix,maxRewritesoption (GHSA-q2hr-2g5m-vwhr / CVE-2026-102277)Other entries are chores: publishing config, formatting, ignoring
.claudein the npm package, and a lock file update.Breaking Changes
None for regular input. The API is unchanged and the new options are optional. Two edge cases behave differently:
{a},b}rewrites.{a},b}rewrite are dropped, e.g.{1},}returns["1}"]instead of["1}", ""].This repository can't reach either case: its own patterns contain no braces, and nyc's default exclude patterns expand identically on the old and new versions. A differential comparison of about 260,000 patterns between the old and new versions found no other output differences. The 1.x line keeps its legacy
${handling.Code Changes Required
None, the upgrade is a drop-in replacement.
minimatch3.1.5 and 5.1.9 call onlyexpand(pattern), and only for patterns that contain a brace set. The project's own patterns (test/**/*.jsfor mocha,./for eslint) contain no braces, and nyc's default exclude patterns use small brace sets far below the limits.