From 881ee6559065460fc21429c38fb818c81ca07ea6 Mon Sep 17 00:00:00 2001 From: olaservo Date: Fri, 14 Aug 2026 11:18:02 -0700 Subject: [PATCH] Patch two high-severity advisories in dev dependencies Both are transitive, lockfile-only, and within the ranges their parents already declare, so no direct dependency moves. - fast-uri 3.1.4 -> 3.1.5 (CVE-2026-18446, GHSA-7p8r-x3mc-p8w7): host confusion via a backslash authority introducer. Reaches the tree through ajv, which declares ^3.0.1. This is Dependabot alert #90, open since 2026-08-04. - brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895): DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation. Reaches the tree through eslint -> minimatch. Not reported by Dependabot. `npm audit` now reports 0 vulnerabilities. Verified the consumers of both packages still work: `eslint schema/` is clean and `tsx scripts/validate-examples.ts` passes 258/258. Co-Authored-By: Claude Opus 5 --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index da6d92605..5dd4fbab7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1239,9 +1239,9 @@ "license": "ISC" }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -1898,9 +1898,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "dev": true, "funding": [ {