Background
Dependabot reports a high-severity vulnerability for brace-expansion (GHSA-mh99-v99m-4gvg / CVE-2026-14257) in:
package-lock.json
Patched version is 5.0.8, but the npm registry feed used in this repo did not provide 5.0.8 at the time of fix, so a direct semver bump failed with ETARGET.
What was done
Updated dependency specs to consume upstream patched tag:
package-lock.json
Regenerated lockfiles so brace-expansion resolves to patched 5.0.8 source.
Verified smoke compile task passes.
Re-ran audit and confirmed the brace-expansion advisory is no longer present.
Validation
Branch: chore-deps-brace-expansion-patch
Commit: a0be2b6
Audit check: no GHSA-mh99-v99m-4gvg / CVE-2026-14257 findings after update.
Follow-up
Once brace-expansion 5.0.8+ is available in the primary npm feed, replace git-tag source with normal semver versioning and refresh lockfiles.
Background
Dependabot reports a high-severity vulnerability for brace-expansion (GHSA-mh99-v99m-4gvg / CVE-2026-14257) in:
package-lock.json
Patched version is 5.0.8, but the npm registry feed used in this repo did not provide 5.0.8 at the time of fix, so a direct semver bump failed with ETARGET.
What was done
Updated dependency specs to consume upstream patched tag:
package-lock.json
Regenerated lockfiles so brace-expansion resolves to patched 5.0.8 source.
Verified smoke compile task passes.
Re-ran audit and confirmed the brace-expansion advisory is no longer present.
Validation
Branch: chore-deps-brace-expansion-patch
Commit: a0be2b6
Audit check: no GHSA-mh99-v99m-4gvg / CVE-2026-14257 findings after update.
Follow-up
Once brace-expansion 5.0.8+ is available in the primary npm feed, replace git-tag source with normal semver versioning and refresh lockfiles.