Bump brace-expansion from 1.1.11 to 1.1.18 in /apps/functional_chat - #80
Conversation
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.11 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 13ea12d. Configure here.
| "d3-node": "^3.0.0", | ||
| "eslint": "8.36.0", | ||
| "eslint-config-next": "latest", | ||
| "eslint-config-next": "*", |
There was a problem hiding this comment.
Lockfile specs drift from package.json
Medium Severity
The lockfile root entry rewrites eslint-config-next, next-auth, @types/react, and typescript from latest to *, but package.json still declares latest. Those specs are not equivalent, so the lockfile is out of sync and npm ci can fail on install.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 13ea12d. Configure here.
There was a problem hiding this comment.
Risk: low. Left a non-blocking comment; Cursor Bugbot finished as skipped and left an unresolved medium-severity finding (lockfile latest→* drift vs package.json), so this is not auto-approved. Assigned reviewers for the functional_chat lockfile path.
Sent by Cursor Approval Agent: Pull Request Approver
Bumps brace-expansion from 1.1.11 to 1.1.18.
Release notes
Sourced from brace-expansion's releases.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)10c05fc1.1.14Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dependency-only security patch in a transitive glob helper; no runtime app code changes, though lockfile churn is large.
Overview
Updates
apps/functional_chat/package-lock.jsonto pull in patchedbrace-expansionreleases used by glob/minimatch-style tooling: 1.1.11 → 1.1.18 at the top level and 2.0.1 → 2.1.4 under nested trees such aseslint-config-nextand sucrase.The lockfile refresh also drops a large set of previously recorded optional/peer packages (e.g.
canvas,ts-node, and related native build helpers) and normalizes a few root dependency version strings in the lock metadata (e.g.latest→*). No application source changes.Reviewed by Cursor Bugbot for commit 13ea12d. Bugbot is set up for automated code reviews on this repo. Configure here.