From ef49b3b6ac8acc370250bdcd4d8723cd6981a434 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 14:24:54 +0000 Subject: [PATCH 1/2] chore: upgrade brace-expansion to address CVE-2026-102276, CVE-2026-102277, CVE-2026-102278 Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/yarn.lock b/yarn.lock index 16aa3ddd3..92e262587 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11513,30 +11513,30 @@ __metadata: linkType: hard "brace-expansion@npm:^1.1.13": - version: 1.1.18 - resolution: "brace-expansion@npm:1.1.18" + version: 1.1.21 + resolution: "brace-expansion@npm:1.1.21" dependencies: balanced-match: "npm:^1.0.0" concat-map: "npm:0.0.1" - checksum: 10c0/3432c18a9e2ebf94162d4effb62198bd0adea06a9f332b2c0188df5d5e30b1e51ea3c848b6608e47d0b857ebe1ea5b3888ed3326dd3c4f6f9645c94153cf9c14 + checksum: 10c0/8f0a68a720f9cb28c2ecaea5cdaf15fafd686d6b6e4e722a81c9d4bd2f68c1fd0619731cac05875d842221eaf4d97d564d329a12eb3c4c22137502fb3c65be8b languageName: node linkType: hard "brace-expansion@npm:^2.0.3": - version: 2.1.4 - resolution: "brace-expansion@npm:2.1.4" + version: 2.1.7 + resolution: "brace-expansion@npm:2.1.7" dependencies: balanced-match: "npm:^1.0.0" - checksum: 10c0/6c0a0e2573eac1dc565b52b1e1bfbeba39bf1830d106ebbc61ff1eaefcf610e9111cd3baa091addd18e33292135c99e019d3184d966389d85dc958fdcdc1449f + checksum: 10c0/17ee4194c85b05cde0a7b7c068eeef664440c027116ef42c3d35c13ebabdc9fd3eaf05c5c8a06dd0ca20ae012d652561d8ac2a699daa5cbee1f0510e5134ab4d languageName: node linkType: hard "brace-expansion@npm:^5.0.5": - version: 5.0.9 - resolution: "brace-expansion@npm:5.0.9" + version: 5.0.12 + resolution: "brace-expansion@npm:5.0.12" dependencies: balanced-match: "npm:^4.0.2" - checksum: 10c0/3dea38884a1c3c8b1c9c44a7402a0c76fca460f70cffb3127242b0b4cbf4472019e022ade021eec44838ff19f1dac2625dfd11dd459d7e1e055b0698a8d52fec + checksum: 10c0/a40ac64d3bdb5bb222456514d3633c1f627f03b844f509c69e70f98b78be0ce85e21b44bbfecdd0ddd4cc0855ca4242b41ea96ddccf88c7c3c7a84405474bb3a languageName: node linkType: hard From fafa48ee8d6e6a2fe1b9d7737b376ee78533016c Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 14:25:38 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for #1700 Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21fd05b6a..20dfeacf5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Silenced a false-positive `MaxListenersExceededWarning` logged on every request proxied through an external rewrite. [#1697](https://github.com/sourcebot-dev/sourcebot/pull/1697) +- Upgraded `brace-expansion` to `^1.1.21`, `^2.1.7`, and `^5.0.12`. [#1700](https://github.com/sourcebot-dev/sourcebot/pull/1700) ## [5.1.15] - 2026-09-29