mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

fix: resolve critical security vulnerability in @isaacs/brace-expansion

Browse Source 
- Added pnpm override to force @isaacs/brace-expansion >= 5.0.1
- Fixes CVE for Uncontrolled Resource Consumption in brace-expansion <=5.0.0
- Transitive dependency from @nestjs/cli > glob > minimatch
- Resolves security-audit failure blocking CI pipeline

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-02-03 19:55:20 -06:00
co-authored by Claude Sonnet 4.5
parent e31cf89437
commit de9ab5d96d
2 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+5
View File
@@ -53,5 +53,10 @@
},
"dependencies": {
"@opentelemetry/resources": "^1.30.1"
},
"pnpm": {
"overrides": {
"@isaacs/brace-expansion": ">=5.0.1"
}
}
}
pnpm-lock.yaml
Generated
+21 -7
View File
@@ -4,6 +4,9 @@ settings:
autoInstallPeers: true
excludeLinksFromLockfile: false
overrides:
'@isaacs/brace-expansion': '>=5.0.1'
importers:
.:
@@ -1424,8 +1427,8 @@ packages:
resolution: {integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==}
engines: {node: 20 || >=22}
'@isaacs/[email protected].0':
resolution: {integrity: sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==}
'@isaacs/[email protected].1':
resolution: {integrity: sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ==}
engines: {node: 20 || >=22}
'@isaacs/[email protected]':
@@ -6985,7 +6988,7 @@ snapshots:
chalk: 5.6.2
commander: 12.1.0
dotenv: 17.2.3
drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@6.19.2([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@5.22.0([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
open: 10.2.0
pg: 8.17.2
prettier: 3.8.1
@@ -7616,7 +7619,7 @@ snapshots:
'@isaacs/[email protected]': {}
'@isaacs/[email protected].0':
'@isaacs/[email protected].1':
dependencies:
'@isaacs/balanced-match': 4.0.1
@@ -9888,7 +9891,7 @@ snapshots:
optionalDependencies:
'@prisma/client': 5.22.0([email protected]([email protected])([email protected]))
better-sqlite3: 12.6.2
drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@6.19.2([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@5.22.0([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
next: 16.1.6(@babel/[email protected])(@opentelemetry/[email protected])([email protected]([email protected]))([email protected])
pg: 8.17.2
prisma: 6.19.2([email protected])([email protected])
@@ -9913,7 +9916,7 @@ snapshots:
optionalDependencies:
'@prisma/client': 6.19.2([email protected]([email protected])([email protected]))([email protected])
better-sqlite3: 12.6.2
drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@6.19.2([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@5.22.0([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
next: 16.1.6(@babel/[email protected])(@opentelemetry/[email protected])([email protected]([email protected]))([email protected])
pg: 8.17.2
prisma: 6.19.2([email protected])([email protected])
@@ -10661,6 +10664,16 @@ snapshots:
[email protected]: {}
[email protected](@opentelemetry/[email protected])(@prisma/[email protected]([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected])):
optionalDependencies:
'@opentelemetry/api': 1.9.0
'@prisma/client': 5.22.0([email protected]([email protected])([email protected]))
'@types/pg': 8.16.0
better-sqlite3: 12.6.2
kysely: 0.28.10
pg: 8.17.2
prisma: 6.19.2([email protected])([email protected])
[email protected](@opentelemetry/[email protected])(@prisma/[email protected]([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected])):
optionalDependencies:
'@opentelemetry/api': 1.9.0
@@ -10670,6 +10683,7 @@ snapshots:
kysely: 0.28.10
pg: 8.17.2
prisma: 6.19.2([email protected])([email protected])
optional: true
[email protected]:
dependencies:
@@ -11686,7 +11700,7 @@ snapshots:
[email protected]:
dependencies:
'@isaacs/brace-expansion': 5.0.0
'@isaacs/brace-expansion': 5.0.1
[email protected]:
dependencies: