From 2af7c0615986cdcdcffc30e07249bb6511ff69bb Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 3 Aug 2026 06:45:11 -0700 Subject: [PATCH] Studio frontend: override brace-expansion 5.0.8 and fast-uri 3.1.4 (#7781) Clears four high-severity advisories in the build and lint tooling: brace-expansion GHSA-3jxr-9vmj-r5cp / CVE-2026-13149 GHSA-mh99-v99m-4gvg / CVE-2026-14257 fast-uri GHSA-4c8g-83qw-93j6 / CVE-2026-13676 GHSA-v2hh-gcrm-f6hx / CVE-2026-16221 Both packages are transitive only, so this goes through the existing overrides block rather than adding phantom direct dependencies. The stale brace-expansion@5.0.5 pin is replaced: it was holding the two 5.x copies at 5.0.6 and blocking npm from resolving them forward. Nothing here reaches the browser bundle. brace-expansion arrives via minimatch under eslint, typescript-eslint and shadcn/ts-morph; fast-uri via ajv under shadcn. Patching them keeps the npm audit and osv-scanner jobs green, which run without --omit=dev by design. 5.0.8 and 3.1.4 are the newest releases older than the 7 day min-release-age floor in studio/frontend/.npmrc. Still outstanding: the dev-only 1.x line, node_modules/brace-expansion 1.1.14 via eslint minimatch@3, needs 1.1.17+ for CVE-2026-14257. 1.1.17 is 4 days old, so it lands in a follow-up once it clears the cooldown. npm audit goes from 11 findings / 5 high to 9 / 3. typecheck, tests and build all pass. Co-authored-by: danielhanchen --- studio/frontend/package-lock.json | 22 +++++++++++----------- studio/frontend/package.json | 3 ++- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/studio/frontend/package-lock.json b/studio/frontend/package-lock.json index d2d103f68a..4f0aedea73 100644 --- a/studio/frontend/package-lock.json +++ b/studio/frontend/package-lock.json @@ -6551,15 +6551,15 @@ } }, "node_modules/@ts-morph/common/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@ts-morph/common/node_modules/minimatch": { @@ -7199,16 +7199,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { @@ -9534,9 +9534,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "funding": [ { "type": "github", diff --git a/studio/frontend/package.json b/studio/frontend/package.json index 45566d9686..1654226480 100644 --- a/studio/frontend/package.json +++ b/studio/frontend/package.json @@ -90,7 +90,8 @@ "hono": "4.12.25", "qs": "6.15.2", "ip-address": "10.1.1", - "brace-expansion@5.0.5": "5.0.6" + "brace-expansion@^5": "5.0.8", + "fast-uri@^3": "3.1.4" }, "devDependencies": { "@biomejs/biome": "^1.9.4",