From 83f8b3cff5e4ee4d3a44861da6428d99193ef236 Mon Sep 17 00:00:00 2001
From: AleksanderSklorz <115619721+AleksanderSklorz@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:02:04 +0200
Subject: [PATCH] [PRODSEC-13315] fix brace expansion do s via exponential time
 expansion of consecutive non expanding groups (#12120)

* [PRODSEC-13315] Fix brace expansion vulnerability

* [PRODSEC-13315] Fix brace expansion vulnerability

* [PRODSEC-13315] Updated pnpm lock
---
 pnpm-lock.yaml      | 10 ++++++----
 pnpm-workspace.yaml |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f566ec1994..32568c0422 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8,6 +8,7 @@ overrides:
   fast-uri: 3.1.4
   js-yaml@4.2.0: 4.3.0
   brace-expansion@5.0.6: 5.0.8
+  brace-expansion@<1.1.17: 1.1.17
   svgo: 4.0.2
   shell-quote: 1.9.0
   adm-zip: 0.6.0
@@ -4931,8 +4932,8 @@ packages:
   boolbase@1.0.0:
     resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
 
-  brace-expansion@1.1.15:
-    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
+  brace-expansion@1.1.17:
+    resolution: {integrity: sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==}
 
   brace-expansion@2.1.1:
     resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==}
@@ -5297,6 +5298,7 @@ packages:
   cron-parser@4.9.0:
     resolution: {integrity: sha512-p0SaNjrHOnQeR8/VnfGbmg9te2kfyYSQ7Sc/j/6DtPL3JQvKxmjO9TSjNFpujqV3vEYYBvNNvXSxzyksBWAx1Q==}
     engines: {node: '>=12.0.0'}
+    deprecated: v4 is no longer maintained, upgrade to v5
 
   cropperjs@1.6.2:
     resolution: {integrity: sha512-nhymn9GdnV3CqiEHJVai54TULFAE3VshJTXSqSJKa8yXAKyBKDWdhHarnlIPrshJ0WMFTGuFvG02YjLXfPiuOA==}
@@ -15197,7 +15199,7 @@ snapshots:
 
   boolbase@1.0.0: {}
 
-  brace-expansion@1.1.15:
+  brace-expansion@1.1.17:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
@@ -17977,7 +17979,7 @@ snapshots:
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 1.1.15
+      brace-expansion: 1.1.17
 
   minimatch@5.1.9:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e5716a9c7f..bdaf913008 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -10,6 +10,7 @@ overrides:
   fast-uri: 3.1.4
   "js-yaml@4.2.0": "4.3.0"
   "brace-expansion@5.0.6": "5.0.8"
+  "brace-expansion@<1.1.17": "1.1.17"
   svgo: 4.0.2
   shell-quote: 1.9.0
   adm-zip: 0.6.0