LotusGuild/cinny
3
0
Fork 0
Code Issues 41 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

deps: brace-expansion 1.1.21 (unblocks CI audit) #257

Merged
jared merged 1 commits from audit-brace-expansion into lotus 2026-09-30 19:41:39 -04:00
Conversation 0 Commits 1 Files Changed 1
+3 -3
jared commented 2026-09-30 19:04:48 -04:00
Owner
Copy Link
Copy Source

npm audit --omit=dev now fails every PR: brace-expansion ≤ 1.1.20 (via @eslint/eslintrc → minimatch@3) has three high-severity DoS advisories (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p).

Change: a lockfile-only patch bump, 1.1.18 → 1.1.21. Nothing else moves.

Checked: npm ci from the new lockfile, then npm audit (clean), eslint, and the unit tests (1,313 pass).

🤖 Generated with Claude Code

https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

`npm audit --omit=dev` now fails every PR: **brace-expansion ≤ 1.1.20** (via `@eslint/eslintrc` → `minimatch@3`) has three high-severity DoS advisories (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p). **Change:** a lockfile-only patch bump, 1.1.18 → 1.1.21. Nothing else moves. **Checked:** `npm ci` from the new lockfile, then `npm audit` (clean), eslint, and the unit tests (1,313 pass). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
jared added 1 commit 2026-09-30 19:04:48 -04:00
deps: brace-expansion 1.1.18 → 1.1.21 (GHSA-q2hr-2g5m-vwhr and two related DoS advisories)
CI / Build & Quality Checks (pull_request) Successful in 1m44s
Details
CI / Trigger Desktop Build (pull_request) Skipped
Details
CI / Docker image build & smoke test (pull_request) Skipped
Details
CI / Secret scan (gitleaks) (pull_request) Successful in 7s
Details
CI / Playwright smoke (e2e) (pull_request) Successful in 11m56s
Details
fbdac30d18 
npm audit --omit=dev started failing every PR: brace-expansion <=1.1.20
(via @eslint/eslintrc → minimatch 3) has three high-severity DoS
advisories. Lockfile-only patch bump; nothing else changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
jared merged commit 4c36c03066 into lotus 2026-09-30 19:41:39 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#257