fix: remediate brace-expansion vulnerability - #131
Merged
dunice merged 3 commits intoSep 16, 2026
Merged
Conversation
Mendr repair b1be3540-4bb1-4e1e-a3c5-f91ea1ea209d
Mendr repair ec3e8aa7-eb7f-48eb-9cd9-25d2e255cc65
…9cd9-25d2e255cc65 fix: remediate js-yaml vulnerability
dunice
approved these changes
Sep 16, 2026
dunice
marked this pull request as ready for review
September 16, 2026 21:54
diego-suntaxi-onfleet
added a commit
that referenced
this pull request
Sep 18, 2026
Resolve package-lock.json conflict by taking master's version: #131 and #132 already landed the same js-yaml 4.3.2 / brace-expansion patches plus new overrides, so this branch no longer changes dependencies. Verified: npm ci in sync, audit clean at high, lint OK, 44 tests passing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Remediated all brace-expansion findings via safe npm overrides and lockfile updates in package.json and package-lock.json.
Validation
Repository setting: Agent decides. The agent chooses relevant checks. Observed results are reported below.
Passed npm ci, 44 tests, lint, lockfile verification, and diff checks. Resolved versions are 1.1.21, 2.1.7, and 5.0.12; audit reports no brace-expansion issues. One unrelated pre-existing js-yaml advisory remains. Validation used Node 24.18.1/npm 11.16.0; Node 20 was unavailable.
Security context
Remediate the reported vulnerabilities in brace-expansion.
Reported advisories: GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, CVE-2026-13149, CVE-2026-14257, CVE-2026-69152
Affected dependency files:
package-lock.jsonIndependent AI review
The repair is acceptable: all brace-expansion lockfile entries are upgraded to fixed versions, with compatible overrides. npm ci, 44 tests, lint, exact-version checks, and diff validation passed. The remaining audit result is the accurately reported pre-existing js-yaml issue.
Execution details
These counts include investigation, setup, checks, and cleanup. They are not a test pass rate. Full command output is retained in the Mendr repair record.
Base:
f472c2fReviewed commit:
694ee18Repair run:
b1be3540-4bb1-4e1e-a3c5-f91ea1ea209d