Skip to content

fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149) #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anupamme wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149) #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 7 additions & 32 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 7 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,5 +44,11 @@
"url": "https://github.com/FortiumPartners/ensemble.git"
},
"author": "Fortium Partners",
"license": "MIT"
"license": "MIT",
"overrides": {
"brace-expansion": "2.1.2"
Comment on lines +48 to +49

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

npm ls brace-expansion --all || true
npm explain brace-expansion
jq -r '
  .packages
  | to_entries[]
  | select(.key | endswith("/brace-expansion"))
  | [.key, .value.version]
  | `@tsv`
' package-lock.json

Repository: FortiumPartners/ensemble

Length of output: 1015

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- package.json relevant section ---\n'
cat -n package.json | sed -n '1,80p'

printf '\n--- package-lock brace-expansion entries ---\n'
jq -r '
  .packages
  | to_entries[]
  | select(.key | endswith("/brace-expansion"))
  | [.key, .value.version]
  | `@tsv`
' package-lock.json 2>/dev/null || true

printf '\n--- package.json overrides field ---\n'
jq '.overrides' package.json 2>/dev/null || true

Repository: FortiumPartners/ensemble

Length of output: 253

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- package.json relevant section ---'
cat -n package.json | sed -n '1,80p'

printf '%s\n' ''
printf '%s\n' '--- package-lock brace-expansion entries ---'
jq -r '
  .packages
  | to_entries[]
  | select(.key | test("/brace-expansion$"))
  | [.key, .value.version]
  | `@tsv`
' package-lock.json 2>/dev/null || true

printf '%s\n' ''
printf '%s\n' '--- package.json overrides field ---'
jq '.overrides' package.json 2>/dev/null || true

Repository: FortiumPartners/ensemble

Length of output: 2714

Scope the brace-expansion override by dependency path.

The root-level "brace-expansion": "2.1.2" override forces every dependency path to that version. Scope the override by the package that needs brace-expansion 2.1.2, and preserve the separate 5.0.7 and 1.1.16 lockfile resolutions for the other dependency paths.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 48 - 49, Update the package.json overrides
configuration to scope brace-expansion version 2.1.2 under the specific
dependent package that requires it, rather than applying it globally. Preserve
the existing lockfile resolutions of 5.0.7 and 1.1.16 for the other dependency
paths.

},
"dependencies": {
"brace-expansion": "2.1.2"
}
Comment on lines +47 to +53

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

npm run validate

Repository: FortiumPartners/ensemble

Length of output: 1041

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package scripts =="
node -e 'const p=require("./package.json"); console.log(JSON.stringify(p.scripts,null,2)); console.log(JSON.stringify(Object.keys(p.dependencies||{}).filter(k=>k.toLowerCase().includes("yaml") || k.toLowerCase().includes("json")), null, 2));'

echo
echo "== validate-all.js outline/size =="
wc -l scripts/validate-all.js
sed -n '1,220p' scripts/validate-all.js

echo
echo "== package.json relevant =="
sed -n '1,90p' package.json

echo
echo "== lockfile brace-expansion and yaml packages =="
python3 - <<'PY'
import json
from pathlib import Path
for name in ["package.json","package-lock.json"]:
    p=Path(name)
    if p.exists():
        data=json.loads(p.read_text())
        print(f"\n--- {name} ---")
        if name=="package-lock.json":
            for key in sorted(data.get("packages",{}).keys()):
                if key in ("","node_modules/brace-expansion","node_modules/yaml","node_modules/@apidevtools/json-schema-ref-parser","node_modules/ajv"):
                    v=data["packages"][key]
                    print(key, v.get("version"), v.get("resolved"), dict(v.get("dependencies",{})), dict(v.get("devDependencies",{})) if key!="") else "")
PY

echo
echo "== lockfile npm cli command references =="
rg -n '"npm|"command":|"npm run|store-dir|marketplace\.json|validate' package-lock.json scripts package.json

Repository: FortiumPartners/ensemble

Length of output: 6956

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json
from pathlib import Path

for name in ["package.json","package-lock.json"]:
    p=Path(name)
    if p.exists():
        data=json.loads(p.read_text())
        print(f"\n--- {name} ---")
        if name=="package-lock.json":
            for key in ("","node_modules/brace-expansion","node_modules/yaml","node_modules/@apidevtools/json-schema-ref-parser","node_modules/ajv","node_modules/ajv-cli","node_modules/ajv-formats"):
                if key in data.get("packages", {}):
                    v=data["packages"][key]
                    print(key, "version=", v.get("version"), "resolved=", v.get("resolved"), "bin=", v.get("bin"), "deps=", v.get("dependencies"), "devDeps=", v.get("devDependencies"))
PY

echo
echo "== npm lockfile integrity summary =="
if [ -f package-lock.json ]; then
  node -e ' const d=require("./package-lock.json"); const pk=d.packages; console.log("rootContentHash=", Object.keys(d).includes("contentHash")). "packages=", Object.keys(pk).length; console.log(Object.keys(pk).filter(k=>k.startsWith("node_modules/")&&k.split("/").length===2).slice(0,50).join("\\n")); '
else
  echo "package-lock.json missing"
fi

echo
echo "== ajv schema references =="
cat -n schemas/marketplace-schema.json | sed -n '1,220p'

echo
echo "== marketplace summary =="
python3 - <<'PY'
import json
from pathlib import Path
p=Path("marketplace.json")
if p.exists():
    data=json.loads(p.read_text())
    keys=sorted(data.keys())
    print("top_keys=", keys)
    if "plugins" in data:
        print("plugin_count=", len(data["plugins"]))
        for i, plugin in enumerate(data["plugins"][:5]):
            print(f"\nplugin {i}")
            for k,v in plugin.items():
                if k in ("name","version","displayName","description","tags","files","settings","capabilities","environment"):
                    print(f"  {k}=", v if not isinstance(v,list) else f"[len={len(v)}]")
PY

echo
echo "== ajv-cli and js-yaml presence in lockfile/installed? =="
node - <<'JS'
const { execSync } = require('child_process');
try { execSync('npm view ajv-cli dist.tarball version --json', {stdio:'inherit'}); }
catch(e) { console.log("npm view failed:", e.message); }
try { execSync('npm view js-yaml dist.tarball version --json', {stdio:'inherit'}); }
catch(e) { console.log("npm view failed:", e.message); }
JS

Repository: FortiumPartners/ensemble

Length of output: 2138

Run, then pass npm run validate before merge.

The required pre-submission validation currently fails, with marketplace.json still marked invalid. Resolve the validation errors and rerun this command until it exits successfully.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 47 - 53, Resolve the validation errors reported
for marketplace.json, then run npm run validate and address any remaining
failures until the command exits successfully.

Source: Coding guidelines

}