admin/0pt

fix(deps): patch HIGH/CRITICAL advisories (brace-expansion) #143

Merged

admin merged 3 commits from fix/cve-lockfile-2026-09-30 into main

2026-09-30 20:52:27 +00:00

Author	SHA1	Message	Date
admin	c00e042399	Merge branch 'main' into fix/cve-lockfile-2026-09-30 CI (SIAX Cloud) / integration (push) Skipped Details CI (SIAX Cloud) / sonar (push) Skipped Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details masterplan-lock / check (pull_request) Successful in 7s Details masterplan-lock / check (push) Successful in 7s Details CI (SIAX Cloud) / security (push) Successful in 27s Details CI (SIAX Cloud) / security (pull_request) Successful in 27s Details CI (SIAX Cloud) / integration (pull_request) Successful in 39s Details Security Scan (SIAX Cloud) / security (pull_request) Successful in 40s Details Security Scan (SIAX Cloud) / security (push) Successful in 52s Details CI (SIAX Cloud) / quality (pull_request) Successful in 1m29s Details CI (SIAX Cloud) / quality (push) Successful in 1m35s Details	2026-09-30 20:52:17 +00:00
Claude CodeandClaude Sonnet 5.5	08fbbf3595	fix(deps): next 16.3.4 -> 16.3.6 (CRITICAL GHSA-vcvr-r3jv-pc5j, next/og RCE) CI (SIAX Cloud) / integration (push) Skipped Details CI (SIAX Cloud) / sonar (push) Skipped Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details masterplan-lock / check (push) Successful in 6s Details masterplan-lock / check (pull_request) Successful in 6s Details CI (SIAX Cloud) / security (push) Successful in 16s Details CI (SIAX Cloud) / security (pull_request) Successful in 17s Details Security Scan (SIAX Cloud) / security (pull_request) Successful in 19s Details Security Scan (SIAX Cloud) / security (push) Successful in 20s Details CI (SIAX Cloud) / integration (pull_request) Successful in 1m2s Details CI (SIAX Cloud) / quality (push) Successful in 1m14s Details CI (SIAX Cloud) / quality (pull_request) Successful in 1m21s Details Same-minor bump of the exact-pinned direct dependency next (16.3.4 and 16.3.5 are affected by the remote code execution in next/og ImageResponse; fixed in 16.3.6, published 2026-09-22). package.json next 16.3.4 -> 16.3.6 (exact pin) pnpm-lock.yaml next + @next/env + 8 @next/swc-* platform packages -> 16.3.6, baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dep) package-lock.json next + @next/env + 8 @next/swc-* -> 16.3.6 (targeted edit; this legacy lockfile is already out of sync with package.json and npm cannot regenerate it because of the workspace:* protocol, so only the next entries were touched) No other dependency changed. pnpm install --frozen-lockfile, typecheck, check:contrast, vitest (1154 passed / 184 skipped), next build and eslint (0 errors) all pass on Node 22. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 17:45:23 +02:00
Claude CodeandClaude Sonnet 5.5	ab051b3bca	fix(deps): patch HIGH advisories in brace-expansion (pnpm-lock.yaml) CI (SIAX Cloud) / integration (push) Skipped Details CI (SIAX Cloud) / sonar (push) Skipped Details masterplan-lock / check (push) Successful in 8s Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details CI (SIAX Cloud) / security (push) Successful in 20s Details masterplan-lock / check (pull_request) Successful in 6s Details Security Scan (SIAX Cloud) / security (pull_request) Successful in 28s Details CI (SIAX Cloud) / security (pull_request) Successful in 32s Details CI (SIAX Cloud) / quality (push) Successful in 50s Details CI (SIAX Cloud) / integration (pull_request) Successful in 58s Details Security Scan (SIAX Cloud) / security (push) Successful in 1m24s Details CI (SIAX Cloud) / quality (pull_request) Successful in 1m38s Details Lockfile-only bump of the transitive dev dependency brace-expansion, within the ranges requested by its parents (minimatch@3 -> ^1.1.7, minimatch@10 -> ^5.x): brace-expansion 1.1.16 -> 1.1.21 brace-expansion 5.0.8 -> 5.0.12 Clears CVE-2026-102276, CVE-2026-102278, CVE-2026-69152 (HIGH, both lines), CVE-2026-14257 (HIGH, 1.1.x) and CVE-2026-102277 (MEDIUM). Resolves to the same versions/integrity hashes package-lock.json already pins. package.json is untouched; no direct dependency changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 11:23:48 +02:00