Repository navigation
build(deps): bump brace-expansion from 1.1.16 to 1.1.18 - #2006
Conversation
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward dependency bump.
What was reviewed: the only change is the brace-expansion transitive dependency in yarn.lock bumped from 1.1.16 to 1.1.18 (a Dependabot security fix, GHSA-mh99-v99m-4gvg), with the checksum updated to match. No source, config, or other lockfile entries changed.
Extended reasoning...
Overview
The only change in this PR is in yarn.lock: the transitive dependency brace-expansion, resolved via the existing "^1.1.7" range, is bumped from version 1.1.16 to 1.1.18, with the corresponding checksum updated. This matches the PR description and is a standard Dependabot security-update PR. No application source code, build configuration, or documentation is touched.
Security risks
None introduced by this change — it is actually a security fix, patching a ReDoS vulnerability in brace-expansion (GHSA-mh99-v99m-4gvg) that was backported into the 1.1.x line. The dependency's own semver range in package.json is unaffected, so no unexpected major/minor bump occurred.
Level of scrutiny
This warrants minimal scrutiny: a single-line dependency version and checksum change in a lockfile, generated automatically by Dependabot, resolving within the existing declared semver range. It is mechanical and low-risk by nature.
Other factors
No CODEOWNERS restrictions apply, no prior review comments are outstanding on this PR, and the diff was verified directly against the stated commit range to confirm it matches the PR description exactly.
|
coverage: 87.336%. remained the same — dependabot/npm_and_yarn/brace-expansion-1.1.18 into main |
2 participants
Bumps brace-expansion from 1.1.16 to 1.1.18.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.