fix: update brace-expansion to >=5.0.8 to resolve CVE-2026-14257 - #413
Conversation
Adds npm override to pin brace-expansion to >=5.0.8, fixing a DoS vulnerability via unbounded expansion length causing OOM crashes. Co-Authored-By: Oz <oz-agent@warp.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@independabot-soc2[bot] I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![oz-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR updates brace-expansion from 5.0.7 to 5.0.8 in package-lock.json and adds a package override to remediate CVE-2026-14257. The lockfile pins the patched tarball and the new package engine range remains compatible with this repository's Node 20.19+/22.12+/24 requirement.
Concerns
- The new override uses a broad lower-bound range rather than pinning the patched dependency version, which makes future non-
npm ciinstalls less deterministic.
Security
- Supply-chain remediation should be reproducible; pinning the override to
5.0.8avoids accidental future major-version resolution while still fixing the vulnerability.
Verdict
Found: 0 critical, 0 important, 1 suggestions
Approve with nits
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
| "yaml": "^2.8.3" | ||
| }, | ||
| "overrides": { | ||
| "brace-expansion": ">=5.0.8", |
There was a problem hiding this comment.
💡 [SUGGESTION] [SECURITY] The lower-bound override can let a future npm install resolve an unreviewed major brace-expansion release; pin the patched version for a reproducible vulnerability fix.
| "brace-expansion": ">=5.0.8", | |
| "brace-expansion": "5.0.8", |
3 participants
Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.
Please merge this PR yourself, if you approve.
BEFORE YOU MERGE
Instructions for resolving the vuln
Added an npm
overridesentry to pinbrace-expansionto>=5.0.8, fixing a high-severity DoS vulnerability.brace-expansionpinned to>=5.0.8(was5.0.7)npm auditno longer reports CVE-2026-14257; brace-expansion 5.0.8 confirmed in package-lock.jsonRisky code / where the dependency was used
brace-expansionis a transitive dependency (runtime scope). It is used internally by glob/minimatch tooling in the build pipeline. The override does not affect direct dependencies.Special instructions for this PR
No special steps required. Verify
npm installsucceeds and the build (npm run build) completes without errors before merging.AFTER YOU MERGE
No post-merge steps required.