From ba084b175cadd7c728ff81a9084705c772a58b67 Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Wed, 22 Jul 2026 01:45:16 +0000 Subject: [PATCH 1/2] UID2-7539/7540/7541: bump brace-expansion, js-yaml, shell-quote (trivy HIGH CVEs) - CVE-2026-13149: brace-expansion -> fixed patch (major-scoped override) - CVE-2026-59869: js-yaml v3 -> 3.15.0 - CVE-2026-13311: shell-quote v1 -> 1.9.0 Fixed via major-scoped npm overrides; package-lock.json regenerated. Build-time transitive deps. Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 19 ++++++++++--------- package.json | 3 +++ 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3f99fed18..f462a32b1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6258,9 +6258,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz", - "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -9310,9 +9310,10 @@ } }, "node_modules/gray-matter/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", + "license": "MIT", "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" @@ -16729,9 +16730,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.9.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz", + "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==", "license": "MIT", "engines": { "node": ">= 0.4" diff --git a/package.json b/package.json index 3d4f74732..ec4d7f954 100644 --- a/package.json +++ b/package.json @@ -50,6 +50,9 @@ "typescript": "^5.6.3" }, "overrides": { + "brace-expansion@5": "5.0.7", + "js-yaml@3": "3.15.0", + "shell-quote@1": "1.9.0", "body-parser@1": "1.20.3", "immutable": "^4.3.8", "minimatch": "^10.2.3", From bb47ec989af3561d4393de5d560d95b2be21a8b6 Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Wed, 22 Jul 2026 01:56:30 +0000 Subject: [PATCH 2/2] UID2-7540: also bump js-yaml v4 to 4.3.0 (CVE-2026-59869 affects 4.x) CVE-2026-59869 fixes the 4.x line at 4.3.0 as well as 3.15.0 for 3.x. The initial commit only pinned v3; js-yaml 4.1.1 was still present and flagged. Added a major-scoped js-yaml@4 -> 4.3.0 override and regenerated the lockfile(s). Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 17 ++++++++++++++--- package.json | 1 + 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index f462a32b1..aed08bcc5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10422,9 +10422,20 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/package.json b/package.json index ec4d7f954..1f3b462d6 100644 --- a/package.json +++ b/package.json @@ -52,6 +52,7 @@ "overrides": { "brace-expansion@5": "5.0.7", "js-yaml@3": "3.15.0", + "js-yaml@4": "4.3.0", "shell-quote@1": "1.9.0", "body-parser@1": "1.20.3", "immutable": "^4.3.8",