From 3f21f92a5f8cf15e862940aa8061c647644c609a Mon Sep 17 00:00:00 2001 From: Ubuntu Date: Wed, 29 Jul 2026 12:49:37 +0000 Subject: [PATCH] security: brace-expansion 1.1.16 (Dependabot #12/#13, both manifests) Fixes CVE-2025-5889 (brace-expansion 1.x ReDoS, vulnerable < 1.1.16). Within-major bump pinned via npm overrides scoped to the 1.x line ("brace-expansion@1": "1.1.16") so the callable minimatch@3-compatible default export is preserved. Applied to both npm projects: - ROOT package.json + package-lock.json (Dependabot #13) - mcp/lua-platform/package.json + package-lock.json (Dependabot #12) brace-expansion 1.1.14 -> 1.1.16 in both lockfiles. npm ci passes in both. Co-Authored-By: Claude Opus 4.8 --- mcp/lua-platform/package-lock.json | 6 +++--- mcp/lua-platform/package.json | 3 ++- package-lock.json | 6 +++--- package.json | 3 ++- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/mcp/lua-platform/package-lock.json b/mcp/lua-platform/package-lock.json index 7ab2851..2ba6bfe 100644 --- a/mcp/lua-platform/package-lock.json +++ b/mcp/lua-platform/package-lock.json @@ -1645,9 +1645,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/mcp/lua-platform/package.json b/mcp/lua-platform/package.json index 711eaf6..956763e 100644 --- a/mcp/lua-platform/package.json +++ b/mcp/lua-platform/package.json @@ -26,6 +26,7 @@ }, "overrides": { "@babel/core": "^7.29.6", - "js-yaml@^3.13.1": "3.15.0" + "js-yaml@^3.13.1": "3.15.0", + "brace-expansion@1": "1.1.16" } } diff --git a/package-lock.json b/package-lock.json index da579e1..c1f95e2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1513,9 +1513,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 6eb383f..bbe6cf1 100644 --- a/package.json +++ b/package.json @@ -21,6 +21,7 @@ "overrides": { "@babel/core": "^7.29.6", "js-yaml@^4.1.0": "4.3.0", - "js-yaml@^3.13.1": "3.15.0" + "js-yaml@^3.13.1": "3.15.0", + "brace-expansion@1": "1.1.16" } }