fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149) - #2820
fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149)#2820anupamme wants to merge 1 commit into
Conversation
Automated dependency upgrade by OrbisAI Security
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
|
Not applicable and also auto-fixed by CI via i.e. #2845 form our GH actions |
2 participants
Summary
Upgrade brace-expansion from 2.1.0 to 5.0.7, 1.1.16, 2.1.2 to fix CVE-2026-13149.
Vulnerability
CVE-2026-13149package-lock.jsonDescription: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
Evidence
Scanner confirmation: trivy rule
CVE-2026-13149flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a web application - XSS and injection vulnerabilities can affect end users.
Changes
package.jsonpackage-lock.jsonBehavior Preservation
The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.
Verification
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security