chore(deps): partially mitigate brace-expansion DoS (CVE-2026-14257) — full fix blocked upstream - #68
Closed
ladykirsah wants to merge 1 commit into
Closed
chore(deps): partially mitigate brace-expansion DoS (CVE-2026-14257) — full fix blocked upstream#68ladykirsah wants to merge 1 commit into
ladykirsah wants to merge 1 commit into
Conversation
…scade)
npm audit flagged 13 HIGH in dev/build tooling that GitHub Dependabot did not
surface. They stem from two roots:
1. brace-expansion (DoS via unbounded expansion) — FIXED HERE.
Bumps the only vulnerable copy 5.0.7 -> 5.0.8 (in-range for its parent
minimatch@10 ^5.0.5; the 1.1.16 and 2.1.2 copies were already patched).
This clears brace-expansion AND every advisory that only cascaded from it:
minimatch, glob, eslint, @eslint/config-array, @eslint/eslintrc,
eslint-config-next, eslint-plugin-import, eslint-plugin-jsx-a11y,
eslint-plugin-react. ~11 of the 13.
2. @node-minify/core (via @opennextjs/aws -> @opennextjs/cloudflare) — NOT fixed.
There is no non-major fix: 8.0.6 is the newest 8.x, and even the latest
adapter (@opennextjs/cloudflare 1.20.2 -> @opennextjs/aws 4.1.0) still pins
@node-minify/core ^8.0.6. The only remediation is forcing @node-minify/core
to 9.x/10.x via override — a 2-major bump on the Cloudflare deploy adapter's
build-time minifier. It runs on our own build output (not attacker input),
so real risk is low. Deferred pending an upstream @opennextjs range bump
rather than risking the deploy build.
Lockfile-only change (4 lines). Verified: 960 tests pass, typecheck clean,
lint 0 errors, admin + storefront both build. (npm's audit endpoint was
returning malformed responses during this work, so the fix is confirmed by
lockfile inspection — no vulnerable brace-expansion remains — plus the green
lint/build that exercise the eslint chain.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ladykirsah
changed the title
Owner
Author
|
Superseded by #70's lockfile regen, which already pulled |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The advisory
GHSA-mh99-v99m-4gvg / CVE-2026-14257 — brace-expansion DoS. Authoritative range:
<= 5.0.7, first patched5.0.8(flat — every version at or below 5.0.7 is affected, across all majors).Our tree has three brace-expansion copies:
5.0.7 → 5.0.8glob@12 → minimatch@10(via@opennextjs/cloudflare,typescript-eslint)minimatch@10uses the5.xnamedexpandexport)2.1.2@node-minify/core@8.0.6 → glob@9 → minimatch@8<= 5.0.7— cannot move1.1.16eslint+ 5 eslint plugins →minimatch@3<= 5.0.7— cannot moveWhy the other two can't be fixed downstream (and why forcing it breaks the build)
minimatch@3andminimatch@8import brace-expansion's default export, which5.xremoved (it exposes only a namedexpand). A globaloverrides: { "brace-expansion": "5.0.8" }makesnpm auditreport0 vulnerabilities— a false green — while the build breaks at runtime withexpand is not a function. Do not do this. This is documented in opennextjs/opennextjs-aws#1204.The real fix is upstream
@node-minify/core+terserto^10.5.0(pullsminimatch@10, compatible with5.x). Open & mergeable but unreviewed since 2026-04-23.eslint-config-next/ the eslint plugins move offminimatch@3upstream.What this PR does
Bumps only the one node that can move safely:
brace-expansion 5.0.7 → 5.0.8on theminimatch@10/glob@12path (in the build/deploy chain). A 4-line lockfile change. It reduces the count of actually-vulnerable nodes without touching anything that would break the build.Verified: admin + storefront both build, 960 tests pass, typecheck clean, lint 0 errors. (npm's audit endpoint was returning malformed responses during this work, so the fix is confirmed by lockfile inspection + the authoritative GHSA range, not a live audit count.)
🤖 Generated with Claude Code