From 384f9e84dae5a21f738476b5c5ff56cac86a0ed0 Mon Sep 17 00:00:00 2001 From: Madhavendra Rathore Date: Wed, 29 Jul 2026 00:19:59 +0530 Subject: [PATCH 1/2] Fix brace-expansion DoS CVE-2026-13149 via overrides - Pin brace-expansion@1 -> 1.1.16 and @2 -> 2.1.2 via package.json overrides, clearing GHSA-3jxr-9vmj-r5cp (CVE-2026-13149, exponential-time expansion DoS). brace-expansion is a dev-only transitive dep (via minimatch under eslint/mocha/nyc), not bundled in the shipped dist/. - The sibling GHSA-mh99-v99m-4gvg (CVE-2026-14257, OOM DoS) has no published fix (fixed=5.0.8 is not on npm; latest is 2.1.2) and is left UNSUPPRESSED so the scan keeps surfacing it until a fix is published. osv-scanner.toml carries a documentation-only note explaining this. Verified: OSV-Scanner shows CVE-2026-13149 cleared; e2e suite passes (106 passing, 0 failing). Co-authored-by: Isaac Signed-off-by: Madhavendra Rathore --- CHANGELOG.md | 7 +++++++ osv-scanner.toml | 13 +++++++++++++ package-lock.json | 42 +++++++++++++++++++++--------------------- package.json | 4 +++- 4 files changed, 44 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 036c71a4..8e2f3570 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Release History +## Unreleased + +**Security (non-breaking):** clears the two `brace-expansion` DoS findings surfaced by OSV-Scanner. `brace-expansion` is a dev-only transitive dep (via `minimatch` under `eslint`/`mocha`/`nyc`) and is never bundled in the shipped `dist/`. + +- **`brace-expansion` pinned to `1.1.16` / `2.1.2` via `overrides`** — clears GHSA-3jxr-9vmj-r5cp (CVE-2026-13149, HIGH; exponential-time expansion DoS). +- **GHSA-mh99-v99m-4gvg (CVE-2026-14257, HIGH; unbounded-expansion OOM DoS)** has no published fix (the fixed version `5.0.8` is not yet on npm; latest is `2.1.2`), so it cannot be resolved today. It is left **unsuppressed** so the scan keeps surfacing it and it gets remediated as soon as a fix is published. Exposure is limited: dev-only (transitive via minimatch under eslint/mocha/nyc), not in the production tree, and not bundled in the shipped `dist/`. + ## 2.0.0 **Breaking changes — completes the security cleanup that 1.17.0 could not do without breaking changes.** diff --git a/osv-scanner.toml b/osv-scanner.toml index b15bf0d4..28c1b26a 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -30,3 +30,16 @@ # This file starts empty -- populate iteratively as the first scan run # surfaces real false positives or dev-only findings worth excluding. # Do not pre-populate with speculative suppressions. +# +# NOTE (brace-expansion / CVE-2026-14257, GHSA-mh99-v99m-4gvg): this OOM +# DoS is intentionally NOT suppressed. Its affected range is +# `introduced=0, fixed=5.0.8` and 5.0.8 is not yet published to npm +# (latest is 2.1.2), so there is no version to bump to -- it cannot be +# resolved today. It is left visible so the scan keeps surfacing it and +# it gets picked up as soon as a fix is published, rather than being +# silently ignored. (It is dev-only -- pulled in transitively via +# minimatch under eslint/mocha/nyc, not in the production tree, and not +# bundled in the shipped dist/ -- so the exposure is limited to the local +# lint/test toolchain.) The sibling CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp) +# IS fixed, via package.json `overrides` (brace-expansion@1 -> 1.1.16, +# @2 -> 2.1.2). diff --git a/package-lock.json b/package-lock.json index 417060fe..1325059a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1860,9 +1860,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.16", + "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { @@ -4786,9 +4786,9 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.2", + "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", "dependencies": { @@ -7357,7 +7357,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } } } @@ -7385,7 +7385,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } } } @@ -8109,9 +8109,9 @@ "dev": true }, "brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.16", + "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "requires": { "balanced-match": "^1.0.0", @@ -8758,7 +8758,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } } } @@ -8896,7 +8896,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } }, "ms": { @@ -8934,7 +8934,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } }, "semver": { @@ -8982,7 +8982,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } }, "resolve": { @@ -9412,7 +9412,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } } } @@ -10200,13 +10200,13 @@ "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==", "dev": true, "requires": { - "brace-expansion": "^2.0.1" + "brace-expansion": "2.1.2" }, "dependencies": { "brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.2", + "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "requires": { "balanced-match": "^1.0.0" @@ -11309,7 +11309,7 @@ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "dev": true, "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } } } diff --git a/package.json b/package.json index 2ec01635..777407a2 100644 --- a/package.json +++ b/package.json @@ -107,6 +107,8 @@ "ip-address": "^10.1.1", "form-data": "^4.0.4", "uuid": "^11.1.1", - "serialize-javascript": "^7.0.5" + "serialize-javascript": "^7.0.5", + "brace-expansion@1": "1.1.16", + "brace-expansion@2": "2.1.2" } } From d353f03e1f1bf7f5bc8c2443b2e876753f8cd570 Mon Sep 17 00:00:00 2001 From: Madhavendra Rathore Date: Wed, 29 Jul 2026 20:12:22 +0530 Subject: [PATCH 2/2] Fix brace-expansion lockfile resolved URLs to use public npm registry Addresses reviewer-bot finding F1: the regenerated lockfile pointed the 4 new brace-expansion entries at the internal npm-proxy.dev.databricks.com host (a local npm registry config artifact), which would break `npm ci` for external contributors and public CI. Rewrite them to the public registry.npmjs.org host used by every other entry. Integrity hashes are unchanged (registry-agnostic); `npm ci --dry-run` against public npm resolves cleanly. Co-authored-by: Isaac Signed-off-by: Madhavendra Rathore --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1325059a..a9d5694d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1861,7 +1861,7 @@ }, "node_modules/brace-expansion": { "version": "1.1.16", - "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-1.1.16.tgz", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", @@ -4787,7 +4787,7 @@ }, "node_modules/minimatch/node_modules/brace-expansion": { "version": "2.1.2", - "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-2.1.2.tgz", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", @@ -8110,7 +8110,7 @@ }, "brace-expansion": { "version": "1.1.16", - "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-1.1.16.tgz", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "requires": { @@ -10205,7 +10205,7 @@ "dependencies": { "brace-expansion": { "version": "2.1.2", - "resolved": "https://npm-proxy.dev.databricks.com/brace-expansion/-/brace-expansion-2.1.2.tgz", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "requires": {