From f047ae223a412bddd453ae9ac208006b7f14dcec Mon Sep 17 00:00:00 2001
From: Min Lim <min.yeol.lim@intel.com>
Date: Mon, 28 Sep 2026 17:34:28 +0000
Subject: [PATCH] Raise resolution floors for two frontend transitive
 dependencies

Bump the pinned floors in the resolutions block to pull in upstream fixes:

- brace-expansion: ^2.1.3 -> ^2.1.4 (now resolves to 2.1.7)
- decode-uri-component: ^0.2.2 -> ^0.5.0

The brace-expansion floor mattered independently of the installed version:
2.1.3 satisfied the old pin but is missing an upstream fix that only landed
in 2.1.4, so the range permitted a resolve we do not want.

Note: decode-uri-component 0.5.0 is ESM-only (export default), while its
only consumer, query-string@7, is CommonJS and uses require(). Vite/Rollup
resolves that interop at bundle time and the production build was verified
to parse normally, but a plain esbuild or bare Node require() of the
package yields the namespace object rather than a callable.
---
 src/gprofiler/frontend/package.json |  4 ++--
 src/gprofiler/frontend/yarn.lock    | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/gprofiler/frontend/package.json b/src/gprofiler/frontend/package.json
index 5aaed13b..b0f6ef31 100644
--- a/src/gprofiler/frontend/package.json
+++ b/src/gprofiler/frontend/package.json
@@ -11,14 +11,14 @@
     "js-yaml": "^4.3.0",
     "diff": "^5.2.2",
     "yaml": "^2.8.3",
-    "brace-expansion": "^2.1.3",
+    "brace-expansion": "^2.1.4",
     "picomatch": "^4.0.4",
     "esbuild": "^0.28.1",
     "@babel/core": "^7.29.6",
     "postcss": "^8.5.18",
     "browserslist": "^4.28.7",
     "nanoid": "^3.3.18",
-    "decode-uri-component": "^0.2.2",
+    "decode-uri-component": "^0.5.0",
     "@humanfs/node": "^0.16.8"
   },
   "dependencies": {
diff --git a/src/gprofiler/frontend/yarn.lock b/src/gprofiler/frontend/yarn.lock
index ff8aea2f..2023ee03 100644
--- a/src/gprofiler/frontend/yarn.lock
+++ b/src/gprofiler/frontend/yarn.lock
@@ -1483,10 +1483,10 @@ baseline-browser-mapping@^2.11.20:
   resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz#99af73cb8e54007e4f5345e132278e26c2662f2c"
   integrity sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==
 
-brace-expansion@^2.0.2, brace-expansion@^2.1.3:
-  version "2.1.4"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.4.tgz#589dab11c0018d0366be64cd8bf12c8dbecc8326"
-  integrity sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==
+brace-expansion@^2.0.2, brace-expansion@^2.1.4:
+  version "2.1.7"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.1.7.tgz#14ea3836731823bb24740225ea43b941b436f9d1"
+  integrity sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==
   dependencies:
     balanced-match "^1.0.0"
 
@@ -1758,10 +1758,10 @@ decode-named-character-reference@^1.0.0:
   dependencies:
     character-entities "^2.0.0"
 
-decode-uri-component@^0.2.2:
-  version "0.2.2"
-  resolved "https://registry.yarnpkg.com/decode-uri-component/-/decode-uri-component-0.2.2.tgz#e69dbe25d37941171dd540e024c444cd5188e1e9"
-  integrity sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==
+decode-uri-component@^0.2.2, decode-uri-component@^0.5.0:
+  version "0.5.0"
+  resolved "https://registry.yarnpkg.com/decode-uri-component/-/decode-uri-component-0.5.0.tgz#4592fa1e1d640ec5e2760e2e168ad2ab5f2c9da1"
+  integrity sha512-1BiQVoK8C9gUbQU6NzAtO/tkz2qOFpEObMWpcFvhx4fYnj4Oc5yzaJN/LD36ihkVUdXyh5ZekzX+yM+ty/SrPg==
 
 deep-is@^0.1.3:
   version "0.1.4"