Bump the brace-expansion override floor past GHSA-rgw5-rvv9-x895 - #616
Conversation
A new high-severity advisory (DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation) covers brace-expansion 4.0.0-5.0.8, which fails npm Audit repo-wide — the job passed an hour earlier on the same lockfile. The existing overrides floor (>=5.0.7, from the prior CVE) is raised to >=5.0.9, the patched release; npm audit reports 0 vulnerabilities and the full TypeScript SDK checks pass with the re-resolved lockfile.
There was a problem hiding this comment.
Pull request overview
This PR raises the transitive-dependency override floor for brace-expansion in the TypeScript SDK to remediate the newly published advisory GHSA-rgw5-rvv9-x895 (high-severity DoS via unbounded intermediate arrays, affecting brace-expansion 4.0.0–5.0.8). The dependency rides in transitively via openapi-typescript → @redocly/openapi-core → minimatch, and because it's pinned by an existing overrides entry, npm audit fix cannot move it — the floor must be raised manually. This unblocks the repo-wide npm Audit CI job that fails on every open PR until it lands. I verified the advisory and that brace-expansion@5.0.9 is the real patched release.
Changes:
- Bump
overrides.brace-expansionfrom>=5.0.7to>=5.0.9intypescript/package.json. - Re-resolve
package-lock.json, moving the singlebrace-expansionentry from5.0.8to5.0.9(version + resolved URL + integrity).
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
typescript/package.json |
Raises the brace-expansion override floor to >=5.0.9 to force the patched release. |
typescript/package-lock.json |
Re-resolves the lockfile to brace-expansion@5.0.9; incidentally strips libc fields from @oxlint/binding-linux-* entries (flagged). |
Files not reviewed (1)
- typescript/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The first resolution ran under the repo toolchain's npm 10.9.8, which predates the libc lockfile field (npm 11.11.0) and stripped it from every oxlint native-binding entry — degrading musl-vs-glibc binary selection and guaranteeing flip-flop churn under the newer npm CI runs. Regenerated with npm 11.17.0: the diff is now exactly the brace-expansion 5.0.8 -> 5.0.9 bump, fields intact. Audit stays clean.
The npm Audit job is red repo-wide as of this afternoon: GHSA-rgw5-rvv9-x895 (high — DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation) covers
brace-expansion4.0.0–5.0.8. The job passed on #614's previous head at ~16:45Z and failed on a SPEC.md-only delta at ~17:51Z — the advisory published in between;mainfails identically.The dep rides in transitively (
openapi-typescript→@redocly/openapi-core→minimatch) under the existingoverridesfloor>=5.0.7from the prior CVE's mitigation.npm audit fixcan't move an overridden dep, so this raises the floor to>=5.0.9(the patched release, published today) and re-resolves the lockfile — the same leaf-bump pattern as #413, zero generated churn.Verification:
npm audit --audit-level=high→ 0 vulnerabilities (REAL_AUDIT_EXIT=0); fullmake ts-checkgreen with the re-resolved lockfile.Every open PR inherits the audit failure until this lands, so it wants to go ahead of the queue (as #605 did this morning for the doc-constants breakage).
Summary by cubic
Raise the
brace-expansionoverride to >=5.0.9 to patch GHSA-rgw5-rvv9-x895 and restore a greennpm auditacross the repo. This unblocks all open PRs.overrides.brace-expansionto>=5.0.9(transitive viaopenapi-typescript→@redocly/openapi-core→minimatch).package-lock.jsonwith npm 11.17 to preserve libc fields; diff is onlybrace-expansion5.0.8 → 5.0.9.npm audit --audit-level=highshows 0 vulnerabilities;make ts-checkpasses.Written for commit 5176582. Summary will update on new commits.