From 2841b3dc0000e4ea1b11caaaafa3cd700f480b05 Mon Sep 17 00:00:00 2001 From: JeffreyChen Date: Thu, 23 Jul 2026 13:09:18 +0800 Subject: [PATCH] Bump brace-expansion out of the exponential-expansion DoS range GHSA/CVE-2026-13149: consecutive non-expanding {} groups expand in exponential time. Dev-scoped dependency of the VS Code extension's build tooling, reached only when building the extension, but the lockfile is what the dependency graph reads. --- autocontrol-lsp/vscode/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/autocontrol-lsp/vscode/package-lock.json b/autocontrol-lsp/vscode/package-lock.json index e318dd49..f24654af 100644 --- a/autocontrol-lsp/vscode/package-lock.json +++ b/autocontrol-lsp/vscode/package-lock.json @@ -485,9 +485,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz", - "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", "dependencies": {