[theo-cf]

Attribution

Raised on behalf of: Rishbh
Dependency remediation for: @yuvraj-clearfeed
Ownership source: https://github.com/clearfeed/node-html-markdown/security/dependabot/80

Summary

Addresses root-lockfile Dependabot alerts #80, #79, and #78: GHSA-q2hr-2g5m-vwhr, quadratic brace-rewrite CPU denial of service.

Fix: Refresh three transitive brace-expansion records within their existing minimatch ranges. Only root yarn.lock changes; no manifest edits, overrides, parent upgrades, or unrelated lock metadata changes. The live open-PR inventory was empty.

Changes

Package lane	From	To	Existing consumer
brace-expansion 1.x	1.1.18	1.1.21	minimatch 3.1.5 → ^1.1.7
brace-expansion 2.x	2.1.4	2.1.7	minimatch 9.0.9 → ^2.0.2
brace-expansion 5.x	5.0.9	5.0.12	minimatch 10.2.4 → ^5.0.2

Dependency tree

root (development dependencies)
├─ jest → coverage/glob tooling → minimatch 3 → brace-expansion 1.1.21
├─ jest → glob 10 → minimatch 9 → brace-expansion 2.1.7
└─ rimraf → glob → minimatch 10 → brace-expansion 5.0.12

Compatibility and scope

All changes are patch-level and satisfy actual parent selectors. Dependency edges and CJS/ESM entrypoints are unchanged. The 5.x lane already required Node 20 || >=22; that development-tool constraint is unchanged and does not raise the published converter's declared Node >=10 engine. Validation ran on Node 22.23.4 / Yarn 1.22.22, not Node 10.

The independent benchmark/yarn.lock and both manifests remain byte-identical to base. Its alerts are not claimed fixed. The normal root prepare hook, including the nested benchmark install, ran successfully.

Testing

• Passed recorded normal installer and final yarn install --non-interactive --prefer-offline --frozen-lockfile, without ignore flags.
• Passed dependency-fix gates for all three alerts, bound to the same base/worktree and authentic install receipts.
• Passed yarn why brace-expansion and theo-git diff --check.
• Passed yarn jest --runInBand: 5 suites, 64 tests.
• Passed all three installed minimatch consumers' ordinary matching/brace cases and hostile-input cap checks; passed actual converter source-load/HTML translation and direct development-tool loads.
• Before/after advisory-shaped inputs of 1,000–4,000 trailing braces: baseline returned two expansions; patched lanes applied the cap and returned one. At 4,000, baseline timings were 112–160 ms; patched timings were 8–13 ms. These bounded local probes are not a production performance benchmark.
• Verified every resolved lane against all four ranges in the live advisory, complete dependency-graph closure, all consumer selectors, and three changed artifacts' npm metadata, URL SHA-1, SRI and downloaded hashes. Every other complete lock record is unchanged.

One initial refresh reused cached vulnerable 2.1.4; its successful install was not credited as remediation. A single affected-package cache clean and integrity-marker invalidation followed by the recorded installer resolved 2.1.7; prior evidence is retained.

Publication

Published as draft through GitHub Git Data API because linked Git metadata is read-only. No executable commit hooks exist; local HEAD/index remain at the validated base. Remote bytes and complete tree scope are verified separately from review completion.

Review status

cf-dependency-review completed at 4b3987d3d6006aa91b598346bcc0b679e9fd15ae: MERGE WITH CAUTION. Ready for human review. Native completion evidence verified; exact reviewer model/provider is unverified and disclosed in the review. Node-22-only validation and the existing Node-16/18 toolchain mismatch remain disclosed; no head-specific CI pass is claimed. This is not merge approval.

[theo-cf]

on behalf of Rishbh:

Reviewed head: 4b3987d3d6006aa91b598346bcc0b679e9fd15ae

Execution provenance: native reviewer completion verified; exact reviewer model/provider is unverified (not exposed by the runner). Requested route: openai-codex/gpt-6.1-sol. Execution: deleg_720c6229:4:sa-4-cc2a6812.

Dependency upgrade review: brace-expansion 1.1.18 / 2.1.4 / 5.0.9 → 1.1.21 / 2.1.7 / 5.0.12

Verdict: MERGE WITH CAUTION — fixes root-lock alerts crosstype#80/crosstype#79/crosstype#78 for GHSA-q2hr-2g5m-vwhr, with no blocking dependency finding; maintainer should explicitly accept Node-22-only validation given the existing Node-16/18 CI/toolchain mismatch and absent exact-head CI results.

Reviewed PR #33 at 4b3987d3d6006aa91b598346bcc0b679e9fd15ae. All three resolved copies clear every range in all ten current, non-withdrawn package advisories; alerts remain open pending merge.

Breaking changes

Version	Change	Affects this repo?	Evidence
1.1.19 / 2.1.5 / 5.0.10	Iterative comma parsing removes stack-exhaustion paths.	No ordinary-call incompatibility found.	Published-source diffs; actual minimatch consumer probes.
1.1.20 / 2.1.6 / 5.0.11	New default nesting-depth cap: 1,000; deeper groups become literal.	Changes pathological development globs, not the converter dependency graph.	Published expand implementations; root production graph excludes this package.
1.1.21 / 2.1.7 / 5.0.12	New default rewrite cap: 1,000; excess rewriting stops.	Intended security behavior; ordinary matching retained.	Recorded direct/actual-parent cap and ordinary-pattern assertions pass in all lanes.
All three lanes	Engines, peers and public entry points unchanged; 1.x/2.x remain CJS, 5.x retains CJS/ESM exports.	No newly raised runtime requirement. Existing development-tool mismatch remains.	5.0.9 and 5.0.12 both require Node `20

No release notes/changelog were available for the nine releases above; each published source and manifest was inspected instead. Intermediate 1.1.19/2.1.5 add unused dist files, removed in the following patch; actual parents load the retained root entry point.

Existing implementation evidence, fingerprint-matched to the reviewed manifest/lockfile, records normal and frozen installs, all three alert gates, 5 Jest suites / 64 tests, minimatch probes and converter source-load/translation passing on Node 22.23.4 / Yarn 1.22.22. These were inspected, not rerun; they do not validate Node 16/18 or the converter's declared Node >=10 support.

Exact-head GitHub state has zero check runs, status contexts and Actions runs, despite the PR-triggered workflow; queued app suites contain zero check runs and are not pending test jobs. CI has not passed.

Resolution conflicts

None. Neither manifest defines resolutions; the root is not a Yarn workspace project. Actual minimatch 3.1.5, 9.0.9 and 10.2.4 manifests request ^1.1.7, ^2.0.2 and ^5.0.2 respectively, all satisfied by the selected versions. No stale or overridden target selectors; all lockfile dependency edges resolve.

Out-of-scope changes

None — only the three required root yarn.lock records change; the other 366 complete records are byte-identical. All three tarball URLs/SHA-1 fragments and SRI values match npm metadata and independently downloaded artifacts. Both manifests and benchmark/yarn.lock remain unchanged; this is not a nested-benchmark remediation.

Workspaces & dependency tree

root package (development dependencies; representative verified paths)
├─ jest@30.2.0
│  └─ @jest/core@30.2.0
│     └─ @jest/reporters@30.2.0
│        ├─ @jest/transform@30.2.0
│        │  └─ babel-plugin-istanbul@7.0.1
│        │     └─ test-exclude@6.0.0
│        │        └─ minimatch@3.1.5 (requests brace-expansion ^1.1.7)
│        │           └─ brace-expansion 1.1.18 → 1.1.21
│        └─ glob@10.5.0
│           └─ minimatch@9.0.9 (requests brace-expansion ^2.0.2)
│              └─ brace-expansion 2.1.4 → 2.1.7
└─ rimraf@6.1.3
   └─ glob@13.0.6
      └─ minimatch@10.2.4 (requests brace-expansion ^5.0.2)
         └─ brace-expansion 5.0.9 → 5.0.12