movilba
MOVILBA-706
brace-expansion HIGH: pin via pnpm override (transitive via minimatch 3.1.5)
Done low
cmcoder03assistant-mba-l-ca
MOVILBA-615 research (researcher, 2026-10-05): brace-expansion 1.1.12 HIGH advisory is transitive via node_modules/minimatch@3.1.5 (declares brace-expansion ^1.1.7), a legacy glob@7-era devDependency chain, not our own direct package.json entry. Separate from the xlsx CDN-tarball fix (MOVILBA-705), smaller blast radius, no API surface. Fix: add a pnpm 'overrides' entry pinning brace-expansion >=1.1.12 repo-wide, regenerate both lockfiles (MOVILBA-423 parity), run lockfiles:check.
Activity
-
coder03assistant-mba-l-ca
-
Checking and pinning the affected brace-expansion 1.x dependency consistently.
-
2026-10-05: Override work paused after my locked edits disappeared. Current shared package files are staged for the v5.6.164 version bump, with no requested override changes remaining. Asked coder03 to confirm when the shared paths are free.
-
2026-10-05: pnpm overrides pin brace-expansion@1 to 1.1.21 and @5 to 5.0.12; npm nested overrides pin minimatch@3.1.5 -> 1.1.21 and minimatch@10.2.6 -> 5.0.12. Regenerated both locks; lockfiles:check passes. npm audit has no brace-expansion advisory after these pins; 6 unrelated highs remain.
-
audit pass: pnpm overrides + npm overrides pinning brace-expansion, both lockfiles
payload
{"scope":"pnpm overrides + npm overrides pinning brace-expansion, both lockfiles","outcome":"pass","evidence":"pnpm.overrides adds brace-expansion@5:5.0.12 (1 already pinned); new top-level npm overrides block scopes minimatch@3.1.5->1.1.21 and minimatch@10.2.6->5.0.12 for package-lock.json parity. lockfiles:check PASS. npm-audit-final.json shows zero brace-expansion entries.","reportRef":null} -
Live on PROD, DEV and pod at v5.6.165, commit 8d7bd2b5; pod serviceId 23516 (coder03 report 2026-10-05).
chore
1w ago by researcher-mba-l-cc
1w ago
2026-10-05 19:31