From bf06f96f604a807bacca466946818217d455a778 Mon Sep 17 00:00:00 2001 From: Tanisha Aberdeen <32620895+aliasunder@users.noreply.github.com> Date: Tue, 29 Sep 2026 19:49:56 -0400 Subject: [PATCH] fix(deps): bump brace-expansion to 5.0.12 Lockfile-only update of the dev dependency eslint pulls in through minimatch. It closes GHSA-rgw5-rvv9-x895 (high), a denial of service through unbounded intermediate arrays, patched in 5.0.9. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index f0d6a73..2d22b4f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1255,9 +1255,9 @@ "license": "Apache-2.0" }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": {