[MelvinBot]

Details

Bumps transitive brace-expansion 1.1.11 → 1.1.21 (latest 1.x) in package-lock.json to fix Dependabot alerts GHSA-v6h2-p8h4-qcjw, GHSA-f886-m6hf-6m8v, GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895 (ReDoS / DoS). Still satisfies minimatch@3's ^1.1.7.

Usage: Dev tooling only. Pulled in via minimatch@3 by eslint, eslint-plugin-*, and glob (@babel/cli) for file glob matching. Not imported in src/ or shipped in dist/.

Change Log

• 1.1.12: Fix ReDoS (GHSA-v6h2-p8h4-qcjw)
• 1.1.13: Fix zero-step sequence hang (GHSA-f886-m6hf-6m8v)
• 1.1.14: Add opt-in { max } expansion limit
• 1.1.15: Backport v5.0.6 fix
• 1.1.16: Fix exponential time on consecutive {} groups (GHSA-3jxr-9vmj-r5cp)
• 1.1.17: Cap expansion length (GHSA-mh99-v99m-4gvg)
• 1.1.18: Cap intermediate arrays (GHSA-rgw5-rvv9-x895)
• 1.1.19–1.1.21: Further upstream security fixes

Full diff: juliangruber/brace-expansion@v1.1.11...v1.1.21

Related Issues

https://github.com/Expensify/Expensify/issues/695887

Manual Tests

1. npm ci succeeds.
2. npm ls brace-expansion shows only 1.1.21.
3. npm run lint and npm run ts pass.
4. npm run build generates dist/.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR