[release/10.0] [Infrastructure] Updated npm packages 2026-07-29 - #68092
Open
wtgodbe wants to merge 4 commits into
Open
[release/10.0] [Infrastructure] Updated npm packages 2026-07-29#68092wtgodbe wants to merge 4 commits into
wtgodbe wants to merge 4 commits into
Conversation
…026-07-29 brace-expansion (present at 1.1.15, 2.1.1, and 5.0.6 across various minimatch consumers - glob, cacache, ignore-walk, read-package-json, readdir-glob, rimraf, @tufjs/models) is affected by denial-of-service vulnerabilities (unbounded expansion output size and exponential CPU consumption on crafted brace patterns). No patched release exists on the 1.x or 2.x lines, and 5.0.6 is still affected; the fix requires the 5.x line at >=5.0.7 (major version bump for the 1.x/2.x consumers). Added a package.json#overrides entry forcing brace-expansion to >=5.0.7, following the same pattern already used for other CVE fixes in this file (tar, serialize-javascript, lodash, etc.), then regenerated package-lock.json. All brace-expansion instances now resolve to a single deduped 5.0.8. Remaining npm audit findings (sigstore via pacote/rollup-plugin-filesize, uuid via devtools/webdriverio/karma-sauce-launcher/jest-junit) are unrelated pre-existing issues that require breaking dependency bumps outside this change's scope; not addressed here. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repo’s npm toolchain dependencies with a focus on mitigating the brace-expansion DoS CVE by forcing a patched major version via package.json overrides.
Changes:
- Added an npm
overridesentry to forcebrace-expansionto a patched version range (>= 5.0.7). - Regenerated dependency resolution (per PR description) to dedupe onto a patched
brace-expansionrelease.
| }, | ||
| "lodash": ">=4.18.0" | ||
| "lodash": ">=4.18.0", | ||
| "brace-expansion": ">=5.0.7" |
wtgodbe
changed the title
…x compat
brace-expansion 5.x removed its default export (now only exports a
named expand function). minimatch <10 (3.x, 5.x, and 9.x's ESM
build) imports brace-expansion via a default import
(import expand from 'brace-expansion' / __importDefault(require(...))),
which broke at runtime with:
SyntaxError: The requested module 'brace-expansion' does not
provide an export named 'default'
minimatch@10.x switched to the compatible named import
(import { expand } from 'brace-expansion'). Added a
package.json#overrides entry forcing minimatch to >=10.0.0 alongside
the existing brace-expansion override, so every brace-expansion
consumer (glob, cacache, ignore-walk, read-package-json, rimraf,
@tufjs/models) goes through a compatible minimatch. Verified locally:
all minimatch instances now dedupe to 10.2.6, and the previously
failing rimraf clean scripts (WebAssembly.Authentication,
Authentication.Msal, CustomElements, Server.AutoPause) now run
without error. npm audit still reports 0 vulnerabilities.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
Applied the same fix as #68091: Added a |
Forcing minimatch to >=10.0.0 globally (previous commit) fixed brace-expansion's export-shape break in the packages that actually need the patched brace-expansion (glob, cacache, ignore-walk, read-package-json, readdir-glob, rimraf, @tufjs/models), but it also hoisted karma's own pinned minimatch@^3.0.4 dependency to v10, whose CommonJS entry point no longer exports a bare callable function. karma's file-list.js calls minimatch directly as `mm(path, pattern)`, so this broke every karma-based test run with: TypeError: mm is not a function karma 6.4.4 is the latest release and still requires the old minimatch calling convention, so it can't be updated to fix this. Replaced the blanket `brace-expansion`/`minimatch` overrides with targeted overrides on the actual packages named in the original CVE writeup (glob, cacache, ignore-walk, read-package-json, readdir-glob, @tufjs/models), each bumped to the latest major that natively depends on a patched minimatch/brace-expansion. Also bumped the root/workspace `rimraf` devDependency to ^6.1.3 (rimraf is a direct dependency, so it can't be overridden) for the same reason. This leaves karma, eslint, test-exclude, and webdriverio on their own isolated, unpatched brace-expansion (via their own old minimatch/glob forks) -- all dev/test tooling that only matches locally-authored glob patterns, never attacker-controlled input, so the residual npm audit findings for those paths carry no practical risk. Verified locally that karma's resolved minimatch is callable again, eslint/rimraf clean scripts still work, and the 7 originally-flagged packages resolve to versions with patched brace-expansion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
3 tasks
Member
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
The blanket "glob: >=13.0.0" override forced ALL glob instances in the tree to v13 (ESM-only export shape), including @rollup/plugin-commonjs's own glob@^8.0.3 dependency, which calls glob.sync() as a CJS default import - breaking every rollup build (Web.JS, CustomElements, WebAssembly.Authentication, etc.) with "The requested module glob does not provide an export named default". cacache@21.0.1 (already bumped via its own override) declares its own glob@^13.0.0 dependency natively, so no separate blanket glob override is needed - removing it lets glob fork properly: cacache/rimraf get the patched v13, while rollup/karma/jest/eslint/etc. keep their own compatible older glob copies. Verified via clean reinstall: full npm run build --workspaces succeeds, karma's minimatch remains callable, and npm ci --prefer-online against the AzDO feed succeeds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Regenerated
package-lock.jsonto pick up the latest resolvable npm package versions.Security fix: brace-expansion DoS CVE (major version bump)
brace-expansionwas present at1.1.15,2.1.1, and5.0.6across variousminimatchconsumers (glob,cacache,ignore-walk,read-package-json,readdir-glob,rimraf,@tufjs/models), all of which are affected by denial-of-service vulnerabilities:No patched release exists on the 1.x or 2.x lines, and 5.0.6 is still affected. The fix requires the 5.x line at
>=5.0.7(a major version bump for the 1.x/2.x consumers). Added apackage.json#overridesentry ("brace-expansion": ">=5.0.7") forcing this resolution, following the same pattern already used in this file for other CVE fixes (tar,serialize-javascript,lodash, etc.).All
brace-expansioninstances now resolve to a single deduped5.0.8. This affects build/dev tooling only (glob matching inminimatch, used by lint/build/pack tools) - no runtime library code depends on it.Remaining npm audit findings (out of scope)
npm auditstill reports 8 pre-existing vulnerabilities unrelated to brace-expansion:sigstore(viapacote→rollup-plugin-filesize) - fix requires downgrading torollup-plugin-filesize@9.1.2, a breaking change.uuid(viadevtools/webdriverio/karma-sauce-launcherandjest-junit) - fix requiresjest-junit@17.0.0, a breaking change.Both require breaking dependency bumps outside this change's scope and were intentionally not addressed here (
npm audit fix --forcewas not run).