The Dependency Audit job now fails on every PR, blocking merges repo-wide. Surfaced on #329, which touches no dependency files.
The advisory
brace-expansion — GHSA-mh99-v99m-4gvg, high severity, DoS via unbounded expansion causing an OOM crash. Vulnerable: <= 5.0.7. Patched: 5.0.8.
We resolve brace-expansion@2.1.0, pulled in transitively by minimatch@9.0.9.
Why there is no one-line fix
minimatch@9.0.9 constrains brace-expansion: ^2.0.2, so the patched 5.0.8 is outside its range. Getting there means either:
- Upgrade
minimatch 9 → 10.2.5 (a major bump of a transitive dep), whose current constraint is ^5.0.5, and which then resolves to a patched line; or
- Force a resolution/override to
5.0.8, which pins a version that minimatch@9.0.9 never declared support for — a 2.x → 5.x jump across an API boundary we would not be testing.
Neither is a mechanical change, and both warrant their own review.
The policy tension worth deciding explicitly
brace-expansion@5.0.8 was published 2026-07-23 — two days ago. Our supply-chain rule requires pinned external deps to bake for 7 days before adoption, precisely to avoid pulling a compromised or broken publish. So the advisory says upgrade now and our own hygiene rule says wait until roughly 2026-07-30.
That conflict should be resolved deliberately rather than by whoever needs their PR unblocked first.
Exposure assessment
Worth stating so severity is calibrated rather than inherited: this is a DoS reachable through glob-pattern expansion. In this repo minimatch is consumed for internal file matching with patterns we author, not attacker-supplied input. Real-world exposure here looks low, even though the advisory's generic rating is high. That argues for choosing the correct fix on the right timeline over an emergency override.
Recommendation
Decide the bake-time question first, then take the minimatch major upgrade as its own reviewed PR with the dep-audit gate left intact. Do not lower or bypass the gate to unblock unrelated work — a security gate that gets waived under delivery pressure stops being a gate.
Blocking: #329.
The
Dependency Auditjob now fails on every PR, blocking merges repo-wide. Surfaced on #329, which touches no dependency files.The advisory
brace-expansion— GHSA-mh99-v99m-4gvg, high severity, DoS via unbounded expansion causing an OOM crash. Vulnerable:<= 5.0.7. Patched:5.0.8.We resolve
brace-expansion@2.1.0, pulled in transitively byminimatch@9.0.9.Why there is no one-line fix
minimatch@9.0.9constrainsbrace-expansion: ^2.0.2, so the patched5.0.8is outside its range. Getting there means either:minimatch9 → 10.2.5 (a major bump of a transitive dep), whose current constraint is^5.0.5, and which then resolves to a patched line; or5.0.8, which pins a version thatminimatch@9.0.9never declared support for — a 2.x → 5.x jump across an API boundary we would not be testing.Neither is a mechanical change, and both warrant their own review.
The policy tension worth deciding explicitly
brace-expansion@5.0.8was published 2026-07-23 — two days ago. Our supply-chain rule requires pinned external deps to bake for 7 days before adoption, precisely to avoid pulling a compromised or broken publish. So the advisory says upgrade now and our own hygiene rule says wait until roughly 2026-07-30.That conflict should be resolved deliberately rather than by whoever needs their PR unblocked first.
Exposure assessment
Worth stating so severity is calibrated rather than inherited: this is a DoS reachable through glob-pattern expansion. In this repo
minimatchis consumed for internal file matching with patterns we author, not attacker-supplied input. Real-world exposure here looks low, even though the advisory's generic rating is high. That argues for choosing the correct fix on the right timeline over an emergency override.Recommendation
Decide the bake-time question first, then take the
minimatchmajor upgrade as its own reviewed PR with the dep-audit gate left intact. Do not lower or bypass the gate to unblock unrelated work — a security gate that gets waived under delivery pressure stops being a gate.Blocking: #329.