[Infrastructure] Updated npm packages 2026-07-29 - #68091
Open
wtgodbe wants to merge 4 commits into
Open
Conversation
…026-07-29 brace-expansion 2.1.2 (pulled in transitively via minimatch from glob, cacache, ignore-walk, read-package-json, readdir-glob, rimraf, and @tufjs/models) is affected by denial-of-service vulnerabilities (unbounded expansion output size and exponential CPU consumption on crafted brace patterns). No patched 2.x release exists; the fix requires the 5.x line (major version bump). Added a package.json#overrides entry forcing brace-expansion to >=5.0.7, following the same pattern already used for other CVE fixes in this file (tar, serialize-javascript, lodash, etc.), then regenerated package-lock.json. All brace-expansion instances now resolve to a single deduped 5.0.8. npm audit reports 0 vulnerabilities. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s npm dependency resolution (via package-lock.json regeneration) and adds an override to ensure brace-expansion resolves to a non-vulnerable major version, addressing the referenced DoS CVE in build/dev tooling dependencies.
Changes:
- Added a root
package.jsonoverride forcingbrace-expansionto resolve to>=5.0.7. - Regenerated
package-lock.jsonto dedupebrace-expansionto5.0.8and pick up the latest resolvable versions for various tooling dependencies.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds an override to force brace-expansion to a patched major version. |
| package-lock.json | Updates resolved dependency graph (dedupes brace-expansion, updates multiple transitive tooling packages). |
Comment on lines
+38
to
42
| "lodash": ">=4.18.0", | ||
| "brace-expansion": ">=5.0.7" | ||
| }, | ||
| "engines": { | ||
| "node": ">=20.9.0", |
…x compat
brace-expansion 5.x removed its default export (now only exports a
named expand function). minimatch <10 (3.x, 5.x, and 9.x's ESM
build) imports brace-expansion via a default import
(import expand from 'brace-expansion' / __importDefault(require(...))),
which broke at runtime with:
SyntaxError: The requested module 'brace-expansion' does not
provide an export named 'default'
minimatch@10.x switched to the compatible named import
(import { expand } from 'brace-expansion'). Added a
package.json#overrides entry forcing minimatch to >=10.0.0 alongside
the existing brace-expansion override, so every brace-expansion
consumer (glob, cacache, ignore-walk, read-package-json, rimraf,
@tufjs/models) goes through a compatible minimatch. Verified locally:
all minimatch instances now dedupe to 10.2.6, and the previously
failing rimraf clean scripts (WebAssembly.Authentication,
Authentication.Msal, CustomElements, Server.AutoPause) now run
without error. npm audit still reports 0 vulnerabilities.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
Fixed a breaking change: Added a |
Forcing minimatch to >=10.0.0 globally (previous commit) fixed brace-expansion's export-shape break in the packages that actually need the patched brace-expansion (glob, cacache, ignore-walk, read-package-json, readdir-glob, rimraf, @tufjs/models), but it also hoisted karma's own pinned minimatch@^3.0.4 dependency to v10, whose CommonJS entry point no longer exports a bare callable function. karma's file-list.js calls minimatch directly as `mm(path, pattern)`, so this broke every karma-based test run with: TypeError: mm is not a function karma 6.4.4 is the latest release and still requires the old minimatch calling convention, so it can't be updated to fix this. Replaced the blanket `brace-expansion`/`minimatch` overrides with targeted overrides on the actual packages named in the original CVE writeup (glob, cacache, ignore-walk, read-package-json, readdir-glob, @tufjs/models), each bumped to the latest major that natively depends on a patched minimatch/brace-expansion. Also bumped the root/workspace `rimraf` devDependency to ^6.1.3 (rimraf is a direct dependency, so it can't be overridden) for the same reason. This leaves karma, eslint, test-exclude, and webdriverio on their own isolated, unpatched brace-expansion (via their own old minimatch/glob forks) -- all dev/test tooling that only matches locally-authored glob patterns, never attacker-controlled input, so the residual npm audit findings for those paths carry no practical risk. Verified locally that karma's resolved minimatch is callable again, eslint/rimraf clean scripts still work, and the 7 originally-flagged packages resolve to versions with patched brace-expansion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
The blanket "glob: >=13.0.0" override forced ALL glob instances in the tree to v13 (ESM-only export shape), including @rollup/plugin-commonjs's own glob@^8.0.3 dependency, which calls glob.sync() as a CJS default import - breaking every rollup build (Web.JS, CustomElements, WebAssembly.Authentication, etc.) with "The requested module glob does not provide an export named default". cacache@21.0.1 (already bumped via its own override) declares its own glob@^13.0.0 dependency natively, so no separate blanket glob override is needed - removing it lets glob fork properly: cacache/rimraf get the patched v13, while rollup/karma/jest/eslint/etc. keep their own compatible older glob copies. Verified via clean reinstall: full npm run build --workspaces succeeds, karma's minimatch remains callable, and npm ci --prefer-online against the AzDO feed succeeds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
Member
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Regenerated
package-lock.jsonto pick up the latest resolvable npm package versions.Security fix: brace-expansion DoS CVE (major version bump)
brace-expansion@2.1.2(pulled in transitively viaminimatchfromglob,cacache,ignore-walk,read-package-json,readdir-glob,rimraf, and@tufjs/models) is affected by denial-of-service vulnerabilities:No patched release exists on the 2.x line, so the fix requires taking a major version bump to the 5.x line. Added a
package.json#overridesentry ("brace-expansion": ">=5.0.7") forcing this resolution, following the same pattern already used in this file for other CVE fixes (tar,serialize-javascript,lodash, etc.).All
brace-expansioninstances now resolve to a single deduped5.0.8.npm auditreports 0 vulnerabilities.npm ls brace-expansionshows a clean dependency tree with no conflicts. This affects build/dev tooling only (glob matching inminimatch, used by lint/build/pack tools) — no runtime library code depends on it.Other notes
npm audit fix --forcewas intentionally not run.