From 64c2c7a483bfdd134ad161fb6ac401818b463405 Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Sat, 25 Jul 2026 20:07:31 +0700 Subject: [PATCH] fix(deps): bump nested brace-expansion to 5.0.8 in client/web The rimraf-scoped brace-expansion resolved to 5.0.7, which is vulnerable to unbounded expansion DoS (GHSA-mh99-v99m-4gvg). minimatch@10.2.5 accepts ^5.0.5, so 5.0.8 resolves without an override. --- client/web/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/client/web/package-lock.json b/client/web/package-lock.json index ce971b5..43fb503 100644 --- a/client/web/package-lock.json +++ b/client/web/package-lock.json @@ -3561,9 +3561,9 @@ } }, "node_modules/rimraf/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": {