Skip to content

Conversation

serhalp
Copy link
Member

@serhalp serhalp commented Jul 3, 2025

Summary

Just ran npm audit fix. For some reason Dependabot couldn't figure this out on its own.

See https://github.com/netlify/cli/security/dependabot/282.

Previously, npm audit reported 1 low severity vulnerability and Dependabot provided these details:

 Transitive dependency brace-expansion 2.0.1 is introduced via

@fastify/static 7.0.4 
...
brace-expansion 2.0.1
@netlify/build 33.5.0
...
brace-expansion 2.0.1
@netlify/build-info 10.0.7
...
brace-expansion 2.0.1
@netlify/zip-it-and-ship-it 12.2.0
...
brace-expansion 2.0.1
@vitest/coverage-v8 3.1.1
...
brace-expansion 2.0.1
@vitest/eslint-plugin 1.2.0
...
brace-expansion 2.0.1
c8 10.1.3
...
brace-expansion 2.0.1
eslint-plugin-n 17.17.0
...
brace-expansion 2.0.1
npm-run-all2 7.0.2
...
brace-expansion 2.0.1
typescript-eslint 8.26.0
...
brace-expansion 2.0.1
verdaccio 6.1.2
... brace-expansion 2.0.1 

Now, npm audit reports:

found 0 vulnerabilities

Closes #7378.

Just ran `npm audit fix`. For some reason Dependabot couldn't figure this out on its own.

See https://github.com/netlify/cli/security/dependabot/282.

Closes #7378.
@serhalp serhalp requested a review from a team as a code owner July 3, 2025 19:42
Copy link

github-actions bot commented Jul 3, 2025

📊 Benchmark results

Comparing with 2e6c9c2

  • Dependency count: 1,105 (no change)
  • Package size: 276 MB (no change)
  • Number of ts-expect-error directives: 399 (no change)

@serhalp serhalp merged commit 6794172 into main Jul 3, 2025
47 checks passed
@serhalp serhalp deleted the fix/dependabot-282 branch July 3, 2025 21:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update brace-expansion to address GHSA-v6h2-p8h4-qcjw
2 participants