Skip to content

[WIP] Upgrade brace-expansion to 5.0.7 #2178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kyoto wants to merge 1 commit into from
+15 −38
Closed

[WIP] Upgrade brace-expansion to 5.0.7 #2178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 14 additions & 38 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@
"webpack-dev-server": "5.2.5"
},
"overrides": {
"brace-expansion": "5.0.7",

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
npm ls brace-expansion minimatch

Repository: openshift/lightspeed-console

Length of output: 1610

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the override and the affected lockfile paths.
python3 - <<'PY'
import json
from pathlib import Path

pkg = json.loads(Path('package.json').read_text())
print('package.json overrides:', pkg.get('overrides', {}))

lock = json.loads(Path('package-lock.json').read_text())
packages = lock.get('packages', {})

for path in [
    '',
    'node_modules/brace-expansion',
    'node_modules/minimatch',
    'node_modules/eslint-plugin-react/node_modules/minimatch',
    'node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch',
    'node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion',
]:
    p = packages.get(path)
    if p is not None:
        print(f'\n[{path or "root"}]')
        for k in ('version', 'dependencies', 'optionalDependencies'):
            if k in p:
                print(k, p[k])

PY

Repository: openshift/lightspeed-console

Length of output: 1441

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read package manifests for the relevant packages to compare declared ranges.
for f in \
  node_modules/minimatch/package.json \
  node_modules/brace-expansion/package.json \
  node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch/package.json \
  node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion/package.json
do
  if [ -f "$f" ]; then
    echo "== $f =="
    python3 - <<'PY' "$f"
import json, sys
from pathlib import Path
p = Path(sys.argv[1])
data = json.loads(p.read_text())
for k in ('name', 'version', 'dependencies', 'exports', 'main'):
    if k in data:
        print(k, data[k])
PY
    echo
  fi
done

Repository: openshift/lightspeed-console

Length of output: 1311

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json
from pathlib import Path

pkg = json.loads(Path('package.json').read_text())
print('overrides:', pkg.get('overrides', {}))

lock = json.loads(Path('package-lock.json').read_text())
for key in ['node_modules/minimatch', 'node_modules/brace-expansion', 'node_modules/eslint-plugin-react/node_modules/minimatch']:
    if key in lock.get('packages', {}):
        print(f'\n{key}:')
        for k, v in lock['packages'][key].items():
            if k in ('version', 'dependencies'):
                print(k, v)
PY

Repository: openshift/lightspeed-console

Length of output: 463

🌐 Web query:

brace-expansion 5.0.7 breaking changes minimatch 3.1.5 compatibility

💡 Result:

Minimatch 3.1.5 does not use brace-expansion 5.0.7; it depends on brace-expansion 1.1.7 [1][2]. There is no direct compatibility between minimatch 3.1.5 and brace-expansion 5.0.7 because minimatch 3.1.5 is a legacy version (v3 branch) that remains locked to the 1.x series of brace-expansion [3][1][2]. The 5.x series of brace-expansion represents a significant major version jump—introducing changes such as ESM-only support [4] and modified behavior for brace parsing [5][6]—which is incompatible with the legacy architecture of minimatch 3.x. If you are seeing security recommendations to upgrade brace-expansion to 5.0.7 or higher while using minimatch 3.1.5 [7], this typically indicates a dependency conflict. Since minimatch 3.1.5 cannot utilize brace-expansion 5.x, you are generally required to either: 1. Upgrade to a modern version of minimatch (v9 or higher, which supports updated dependencies). 2. Accept that the legacy minimatch 3.x branch cannot be patched to use brace-expansion 5.x, and if you are maintaining a project relying on minimatch 3.1.5, you may need to apply specific patches to the 1.x version of brace-expansion if they are backported, or migrate away from the legacy library entirely [7][8]. Brace-expansion 5.x introduced critical fixes, such as sanitizing zero-step numeric sequences (e.g., {1..2..0}) to prevent infinite loops and memory exhaustion [5]. These vulnerabilities were also backported to brace-expansion 1.1.15 [5][9][4], which is the recommended version for projects that must remain on the legacy 1.x line.

Citations:

Scope the brace-expansion override in package.json:74

This global override breaks the legacy minimatch@3.1.5 subtree, which still requires brace-expansion@^1.1.7. Keep the override limited to the newer consumers or leave the old path on a compatible 1.x release.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 74, The global brace-expansion override in package.json
is forcing all consumers to 5.0.7 and breaking the minimatch@3.1.5 subtree.
Update the overrides so only the newer dependency paths get brace-expansion 5.x,
and keep the legacy minimatch path on a compatible 1.1.x release; use the
existing override entry in package.json to scope it narrowly.

"dompurify": "3.4.11",
"js-cookie": "3.0.8",
"monaco-editor": "0.55.1",
Expand Down