From f8de669439f4364eb2146c232f68fafff618aeba Mon Sep 17 00:00:00 2001 From: Erik Schultink Date: Wed, 26 Aug 2026 21:32:51 -0700 Subject: [PATCH] Override brace-expansion to 2.1.4 to address Dependabot alert #49. 2.1.0 is still in the lockfile via minimatch; 2.1.4 patches CVE-2026-14257 and the follow-on GHSA-rgw5-rvv9-x895 bypass. Co-authored-by: Cursor --- package-lock.json | 6 +++--- package.json | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 43d2d6c..e99e5f7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -779,9 +779,9 @@ } }, "node_modules/brace-expansion": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz", - "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" diff --git a/package.json b/package.json index e3e7cde..9ca2ccb 100644 --- a/package.json +++ b/package.json @@ -28,6 +28,7 @@ "vitest": "^4.1.5" }, "overrides": { - "protobufjs": "^7.6.2" + "protobufjs": "^7.6.2", + "brace-expansion": "2.1.4" } }