vrr/unsloth
2
0
Fork 0
mirror of https://github.com/unslothai/unsloth.git synced 2026-08-25 08:42:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 29

Studio frontend: override brace-expansion 5.0.8 and fast-uri 3.1.4 (#7781)

Browse source 
Clears four high-severity advisories in the build and lint tooling:

  brace-expansion  GHSA-3jxr-9vmj-r5cp / CVE-2026-13149
                   GHSA-mh99-v99m-4gvg / CVE-2026-14257
  fast-uri         GHSA-4c8g-83qw-93j6 / CVE-2026-13676
                   GHSA-v2hh-gcrm-f6hx / CVE-2026-16221

Both packages are transitive only, so this goes through the existing
overrides block rather than adding phantom direct dependencies. The
stale brace-expansion@5.0.5 pin is replaced: it was holding the two
5.x copies at 5.0.6 and blocking npm from resolving them forward.

Nothing here reaches the browser bundle. brace-expansion arrives via
minimatch under eslint, typescript-eslint and shadcn/ts-morph;
fast-uri via ajv under shadcn. Patching them keeps the npm audit and
osv-scanner jobs green, which run without --omit=dev by design.

5.0.8 and 3.1.4 are the newest releases older than the 7 day
min-release-age floor in studio/frontend/.npmrc.

Still outstanding: the dev-only 1.x line, node_modules/brace-expansion
1.1.14 via eslint minimatch@3, needs 1.1.17+ for CVE-2026-14257.
1.1.17 is 4 days old, so it lands in a follow-up once it clears the
cooldown.

npm audit goes from 11 findings / 5 high to 9 / 3. typecheck, tests
and build all pass.

Co-authored-by: danielhanchen <unslothshared@gmail.com>
This commit is contained in:
Daniel Han 2026-08-03 06:45:11 -07:00 • committed by GitHub
parent d27ac18095
commit 2af7c06159
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

22
studio/frontend/package-lock.json generated
View file

@ -6551,15 +6551,15 @@
}
},
"node_modules/@ts-morph/common/node_modules/brace-expansion": {
"version": "5.0.6",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
"version": "5.0.8",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
"node": "18 || 20 || >=22"
"node": "20 || >=22"
}
},
"node_modules/@ts-morph/common/node_modules/minimatch": {
@ -7199,16 +7199,16 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
"version": "5.0.6",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
"version": "5.0.8",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
"node": "18 || 20 || >=22"
"node": "20 || >=22"
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
@ -9534,9 +9534,9 @@
}
},
"node_modules/fast-uri": {
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
"integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
"version": "3.1.4",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
"integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
"funding": [
{
"type": "github",

3
studio/frontend/package.json
View file

@ -90,7 +90,8 @@
"hono": "4.12.25",
"qs": "6.15.2",
"ip-address": "10.1.1",
"brace-expansion@5.0.5": "5.0.6"
"brace-expansion@^5": "5.0.8",
"fast-uri@^3": "3.1.4"
},
"devDependencies": {
"@biomejs/biome": "^1.9.4",