Skip to content

fix(deps): vuln brace-expansion (patch → 2.1.4) [azure] - #1189

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/azure/0-1785819703
Open

fix(deps): vuln brace-expansion (patch → 2.1.4) [azure]#1189
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/azure/0-1785819703

Conversation

@gh-worker-campaigns-3e9aa4

Copy link
Copy Markdown
Contributor

Summary: High-severity security update — 1 package upgraded (patch changes only)

Manifests changed:

  • azure (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.


Updates

Package From To Type Dep Type Vulnerabilities Fixed
brace-expansion 2.1.2 2.1.4 patch Transitive 3 HIGH

Security Details

🚨 Critical & High Severity (3 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.1.2 1.1.18 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.1.2 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.1.2 - -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment