fix(deps): patch HIGH/CRITICAL advisories (brace-expansion) #143

Merged

admin merged 3 commits from fix/cve-lockfile-2026-09-30 into main 2026-09-30 20:52:27 +00:00

Conversation 1 Commits 3 Files Changed 3

+91 -98

admin commented 2026-09-30 09:24:11 +00:00

Owner

Copy Link

Copy Source

Summary

Lockfile-only patch of the transitive dev dependency brace-expansion in pnpm-lock.yaml (the canonical lockfile: packageManager: pnpm@9.15.9, CI installs with pnpm install --frozen-lockfile). No package.json change, no direct dependency touched, no override needed.

package	before	after
brace-expansion (via minimatch@3.1.5, range ^1.1.7)	1.1.16	1.1.21
brace-expansion (via minimatch@10.2.5, range ^5.x)	5.0.8	5.0.12

Done with pnpm update brace-expansion -r --lockfile-only --depth Infinity; the diff is exactly 8 lines (the two package entries, the two snapshot entries, the two minimatch references). The new versions and integrity hashes are identical to what package-lock.json already pins.

Not affected in this repo: fast-uri and @xhmikosr/decompress are not in either lockfile.

Findings before / after (Trivy 0.73.0, freshly downloaded vuln DB, UpdatedAt 2026-09-30T07:10Z)

CI's blocking command (trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .) suppresses dev dependencies by default and was already green on this repo (0 findings, exit 0), so this PR is preventive hygiene. With --include-dev-deps:

• Before: 7 HIGH + 2 MEDIUM, all brace-expansion in pnpm-lock.yaml: CVE-2026-102276 (HIGH, both lines), CVE-2026-102278 (HIGH, both), CVE-2026-69152 (HIGH, both), CVE-2026-14257 (HIGH, 1.1.x), CVE-2026-102277 (MEDIUM, both). package-lock.json was already clean.
• After: 0 HIGH / 0 CRITICAL. CI-equivalent scan with secrets: 0 vuln, 0 secret, exit 0.

Remaining (not addressed, out of scope):

• CVE-2026-84373 (MEDIUM) vitest/@vitest/mocker 3.2.7, fixed only in 4.1.11 / 5.0.0-rc.2: direct dev dependency major bump, deliberately not done here.
• CVE-2026-28684 (MEDIUM) python-dotenv 1.0.1 in services/api/requirements.txt: MEDIUM, and outside this lane.
• services/scrapers/requirements.txt stays unpinned by the documented owner decision; untouched.

Checks run (local, Node v26 with pnpm 9.15.9)

• pnpm install --frozen-lockfile: OK (resolved brace-expansion 1.1.21 + 5.0.12 in node_modules/.pnpm)
• pnpm run typecheck (tsc -p tsconfig.check.json): OK, no errors
• pnpm run test (vitest): 100 files passed / 22 skipped, 1154 tests passed / 184 skipped
• pnpm run lint (eslint, exercises minimatch/brace-expansion): 0 errors, 9 pre-existing warnings
• pnpm run build (next build): OK
• pnpm audit --prod --audit-level high: No known vulnerabilities found
• Not run: e2e / real-infra tests, docker build, CD.

Merge and deploy decisions are left to the owner; nothing was merged or deployed.

🤖 Generated with Claude Code

## Summary Lockfile-only patch of the transitive **dev** dependency `brace-expansion` in `pnpm-lock.yaml` (the canonical lockfile: `packageManager: pnpm@9.15.9`, CI installs with `pnpm install --frozen-lockfile`). No `package.json` change, no direct dependency touched, no override needed. | package | before | after | | --- | --- | --- | | brace-expansion (via minimatch@3.1.5, range `^1.1.7`) | 1.1.16 | 1.1.21 | | brace-expansion (via minimatch@10.2.5, range `^5.x`) | 5.0.8 | 5.0.12 | Done with `pnpm update brace-expansion -r --lockfile-only --depth Infinity`; the diff is exactly 8 lines (the two package entries, the two snapshot entries, the two `minimatch` references). The new versions and integrity hashes are identical to what `package-lock.json` already pins. Not affected in this repo: `fast-uri` and `@xhmikosr/decompress` are not in either lockfile. ## Findings before / after (Trivy 0.73.0, freshly downloaded vuln DB, UpdatedAt 2026-09-30T07:10Z) CI's blocking command (`trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .`) suppresses dev dependencies by default and was already green on this repo (0 findings, exit 0), so this PR is preventive hygiene. With `--include-dev-deps`: - **Before:** 7 HIGH + 2 MEDIUM, all `brace-expansion` in `pnpm-lock.yaml`: CVE-2026-102276 (HIGH, both lines), CVE-2026-102278 (HIGH, both), CVE-2026-69152 (HIGH, both), CVE-2026-14257 (HIGH, 1.1.x), CVE-2026-102277 (MEDIUM, both). `package-lock.json` was already clean. - **After:** 0 HIGH / 0 CRITICAL. CI-equivalent scan with secrets: 0 vuln, 0 secret, exit 0. Remaining (not addressed, out of scope): - CVE-2026-84373 (MEDIUM) `vitest`/`@vitest/mocker` 3.2.7, fixed only in 4.1.11 / 5.0.0-rc.2: direct dev dependency major bump, deliberately not done here. - CVE-2026-28684 (MEDIUM) `python-dotenv` 1.0.1 in `services/api/requirements.txt`: MEDIUM, and outside this lane. - `services/scrapers/requirements.txt` stays unpinned by the documented owner decision; untouched. ## Checks run (local, Node v26 with pnpm 9.15.9) - `pnpm install --frozen-lockfile`: OK (resolved brace-expansion 1.1.21 + 5.0.12 in `node_modules/.pnpm`) - `pnpm run typecheck` (tsc -p tsconfig.check.json): OK, no errors - `pnpm run test` (vitest): 100 files passed / 22 skipped, 1154 tests passed / 184 skipped - `pnpm run lint` (eslint, exercises minimatch/brace-expansion): 0 errors, 9 pre-existing warnings - `pnpm run build` (next build): OK - `pnpm audit --prod --audit-level high`: No known vulnerabilities found - Not run: e2e / real-infra tests, docker build, CD. Merge and deploy decisions are left to the owner; nothing was merged or deployed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

admin added 1 commit 2026-09-30 09:24:12 +00:00

fix(deps): patch HIGH advisories in brace-expansion (pnpm-lock.yaml) ... ab051b3bca

Lockfile-only bump of the transitive dev dependency brace-expansion, within
the ranges requested by its parents (minimatch@3 -> ^1.1.7, minimatch@10 ->
^5.x):

  brace-expansion 1.1.16 -> 1.1.21
  brace-expansion 5.0.8  -> 5.0.12

Clears CVE-2026-102276, CVE-2026-102278, CVE-2026-69152 (HIGH, both lines),
CVE-2026-14257 (HIGH, 1.1.x) and CVE-2026-102277 (MEDIUM). Resolves to the same
versions/integrity hashes package-lock.json already pins. package.json is
untouched; no direct dependency changed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CODEOWNERS rules requested review from sax3l 2026-09-30 09:24:12 +00:00

admin added 1 commit 2026-09-30 15:45:27 +00:00

fix(deps): next 16.3.4 -> 16.3.6 (CRITICAL GHSA-vcvr-r3jv-pc5j, next/og RCE) ... 08fbbf3595

Same-minor bump of the exact-pinned direct dependency next (16.3.4 and 16.3.5
are affected by the remote code execution in next/og ImageResponse; fixed in
16.3.6, published 2026-09-22).

  package.json     next 16.3.4 -> 16.3.6 (exact pin)
  pnpm-lock.yaml   next + @next/env + 8 @next/swc-* platform packages -> 16.3.6,
                   baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dep)
  package-lock.json  next + @next/env + 8 @next/swc-* -> 16.3.6 (targeted edit;
                   this legacy lockfile is already out of sync with package.json
                   and npm cannot regenerate it because of the workspace:*
                   protocol, so only the next entries were touched)

No other dependency changed. pnpm install --frozen-lockfile, typecheck,
check:contrast, vitest (1154 passed / 184 skipped), next build and eslint
(0 errors) all pass on Node 22.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

admin commented 2026-09-30 15:45:35 +00:00

Author

Owner

Copy Link

Copy Source

OSV re-sweep of this branch (api.osv.dev, both lockfiles), follow-up commit 08fbbf3.

Before this commit (branch head ab051b3): critical=1, high=0

• CRITICAL next@16.3.4, GHSA-vcvr-r3jv-pc5j (Next.js RCE in next/og ImageResponse), fixed in 16.3.6, in package-lock.json and pnpm-lock.yaml

After (08fbbf3): critical=0, high=0 (642 lockfile pairs scanned)

Change (manifests and lockfiles only):

• package.json: next 16.3.4 -> 16.3.6 (exact pin, same minor line; 16.3.6 was published 2026-09-22, older than 7 days)
• pnpm-lock.yaml: next, @next/env and the 8 @next/swc-* packages -> 16.3.6; baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dependency)
• package-lock.json: only the next, @next/env and @next/swc-* entries. This legacy lockfile is already out of sync with package.json (recharts, @siax/ui, sonner, cmdk) and npm cannot regenerate it because of the workspace:* protocol, so it was patched in place and nothing else in it was touched. CI, the Dockerfile and the Makefile all use pnpm and pnpm-lock.yaml.
• No guard/pin file, workflow, or test changed.

Checks run (Node 22, pnpm 9.15.9):

• pnpm install --frozen-lockfile: OK, resolves next 16.3.6
• pnpm run typecheck: OK
• pnpm run check:contrast: OK
• pnpm run test (vitest): 100 files passed, 22 skipped; 1154 tests passed, 184 skipped, 0 failed
• pnpm run build (next build, Next.js 16.3.6 Turbopack): OK
• pnpm run lint: 0 errors, 9 warnings (advisory step in CI)

Not run: tests/integration suites (skipped locally, they need live OpenSearch/ClickHouse service containers, which CI provides), Docker image build, npm ci (package-lock.json is not used by the pipeline and is stale independent of this change).

🤖 Generated with Claude Code

OSV re-sweep of this branch (api.osv.dev, both lockfiles), follow-up commit 08fbbf3. **Before this commit (branch head ab051b3):** critical=1, high=0 - CRITICAL next@16.3.4, GHSA-vcvr-r3jv-pc5j (Next.js RCE in next/og ImageResponse), fixed in 16.3.6, in package-lock.json and pnpm-lock.yaml **After (08fbbf3):** critical=0, high=0 (642 lockfile pairs scanned) **Change (manifests and lockfiles only):** - package.json: next 16.3.4 -> 16.3.6 (exact pin, same minor line; 16.3.6 was published 2026-09-22, older than 7 days) - pnpm-lock.yaml: next, @next/env and the 8 @next/swc-* packages -> 16.3.6; baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dependency) - package-lock.json: only the next, @next/env and @next/swc-* entries. This legacy lockfile is already out of sync with package.json (recharts, @siax/ui, sonner, cmdk) and npm cannot regenerate it because of the `workspace:*` protocol, so it was patched in place and nothing else in it was touched. CI, the Dockerfile and the Makefile all use pnpm and pnpm-lock.yaml. - No guard/pin file, workflow, or test changed. **Checks run (Node 22, pnpm 9.15.9):** - `pnpm install --frozen-lockfile`: OK, resolves next 16.3.6 - `pnpm run typecheck`: OK - `pnpm run check:contrast`: OK - `pnpm run test` (vitest): 100 files passed, 22 skipped; 1154 tests passed, 184 skipped, 0 failed - `pnpm run build` (next build, Next.js 16.3.6 Turbopack): OK - `pnpm run lint`: 0 errors, 9 warnings (advisory step in CI) **Not run:** tests/integration suites (skipped locally, they need live OpenSearch/ClickHouse service containers, which CI provides), Docker image build, `npm ci` (package-lock.json is not used by the pipeline and is stale independent of this change). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

admin added 1 commit 2026-09-30 20:52:21 +00:00

Merge branch 'main' into fix/cve-lockfile-2026-09-30 c00e042399

admin merged commit 5def469190 into main 2026-09-30 20:52:27 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

sax3l

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/0pt#143