Uh oh!
There was an error while loading. Please reload this page.
fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) - #1599
Merged
Merged
Conversation
…d dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closes#1596
CopilotAI
changed the title
[WIP] Update bundled brace-expansion for GHSA-3jxr-9vmj-r5cpfix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS)Jul 28, 2026
…icense cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x) - `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion.
There was a problem hiding this comment.
Pull request overview
This PR aims to remediate GHSA-3jxr-9vmj-r5cp by updating brace-expansion versions used by the action (including the committed dist/ bundles) so the shipped JavaScript no longer contains vulnerable implementations.
Changes:
- Added an npm
overridesentry intended to forcebrace-expansionto a patched version. - Updated
package-lock.jsondependency resolution accordingly. - Updated tracked third-party license metadata under
.licenses/to match the new dependency set (and rebuiltdist/artifacts per PR description).
Reviewed changes
Copilot reviewed 5 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| package.json | Introduces an npm override to pin brace-expansion (currently forces all paths to 5.0.8). |
| package-lock.json | Updates the resolved dependency graph; currently results in only brace-expansion@5.0.8 being present. |
| dist/setup/index.js | Rebuilt bundle; contains inlined balanced-match + brace-expansion module code. |
| dist/cache-save/index.js | Rebuilt bundle; contains inlined balanced-match + brace-expansion module code. |
| .licenses/npm/concat-map.dep.yml | Removes license metadata for concat-map (no longer in lock). |
| .licenses/npm/brace-expansion.dep.yml | Updates license metadata version for brace-expansion to 5.0.8. |
| .licenses/npm/brace-expansion-1.1.13.dep.yml | Removes license metadata for the prior brace-expansion@1.1.13. |
| .licenses/npm/balanced-match.dep.yml | Adds license metadata for balanced-match@4.0.4. |
| .licenses/npm/balanced-match-1.0.2.dep.yml | Removes license metadata for the prior balanced-match@1.0.2. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
priya-kinthali
approved these changes
Jul 28, 2026
HarithaVattikuti
approved these changes
Jul 29, 2026
Uh oh!
There was an error while loading. Please reload this page.
1 task
gowridurgad pushed a commit
to gowridurgad/setup-node
that referenced
this pull request
Aug 11, 2026
…-time DoS) (actions#1599) * Initial plan * fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closesactions#1596 * fix: eliminate remaining brace-expansion vulnerabilities and update license cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x) - `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion. * fix: replace brace-expansion workarounds with single override --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request primarily updates the
brace-expansionnpm dependency to version 5.0.8 and removes several legacy license metadata files for now-unused or replaced dependencies. The update ensures that only the latest version ofbrace-expansionis referenced and that the codebase is not cluttered with outdated license files.Dependency updates:
brace-expansionnpm package to version 5.0.8 by renaming the license file and adding an explicit override inpackage.jsonto ensure the correct version is used. [1][2]License metadata cleanup:
brace-expansion@1.1.13,balanced-match@1.0.2, andconcat-map@0.0.1, as these versions are no longer used in the project. [1][2][3]