From ddee2cca982dacc856147d979986e0462c741e1f Mon Sep 17 00:00:00 2001
From: tabedzki <35670232+tabedzki@users.noreply.github.com>
Date: Sun, 11 Oct 2026 20:27:29 +0000
Subject: [PATCH] [AI] fix: bump brace-expansion to resolve HIGH CVEs (#9179)

Refresh yarn.lock with `yarn up -R brace-expansion` so the 2.x range
(^2.0.1, ^2.0.2, pulled in via minimatch@5/9 and shipped in the
sync-server image through migrate) resolves to 2.1.7 instead of 2.0.3.
This clears CVE-2026-13149, CVE-2026-14257, CVE-2026-69152,
CVE-2026-102276 and CVE-2026-102278. The 5.x range moves from 5.0.5 to
5.0.12 as part of the same refresh; 1.x is already at the latest 1.1.21.

No resolutions override is needed; both versions are in range of the
existing specifiers. Fixes #9166.

Assisted-by: ClaudeCode:claude-opus-5-5
---
 upcoming-release-notes/bump-brace-expansion.md |  6 ++++++
 yarn.lock                                      | 12 ++++++------
 2 files changed, 12 insertions(+), 6 deletions(-)
 create mode 100644 upcoming-release-notes/bump-brace-expansion.md

diff --git a/upcoming-release-notes/bump-brace-expansion.md b/upcoming-release-notes/bump-brace-expansion.md
new file mode 100644
index 0000000000..96cf4726ba
--- /dev/null
+++ b/upcoming-release-notes/bump-brace-expansion.md
@@ -0,0 +1,6 @@
+---
+category: Maintenance
+authors: [tabedzki]
+---
+
+Update `brace-expansion` to 2.1.7 and 5.0.12 to address security advisories reported against the server image.
diff --git a/yarn.lock b/yarn.lock
index 250f9823ec..a56d3d61bc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10930,20 +10930,20 @@ __metadata:
   linkType: hard
 
 "brace-expansion@npm:^2.0.1, brace-expansion@npm:^2.0.2":
-  version: 2.0.3
-  resolution: "brace-expansion@npm:2.0.3"
+  version: 2.1.7
+  resolution: "brace-expansion@npm:2.1.7"
   dependencies:
     balanced-match: "npm:^1.0.0"
-  checksum: 10/e9dd66caaf0784126e1654f1bc19adb28f3ef86f39f2226f833f7700ec727c141f6cd85eaa47bacf3426beda01c9fbc3a2f28174cf59330dc9b58ffaf9e09d96
+  checksum: 10/4763be07b688136db4f98f71ab96c4a1a73b6785f69864c130c748f4429be961c6a9a4129c0a81aad4f9cfb08e31a3cf2809b2427509bf2990d1490b7b5dd2d0
   languageName: node
   linkType: hard
 
 "brace-expansion@npm:^5.0.5":
-  version: 5.0.5
-  resolution: "brace-expansion@npm:5.0.5"
+  version: 5.0.12
+  resolution: "brace-expansion@npm:5.0.12"
   dependencies:
     balanced-match: "npm:^4.0.2"
-  checksum: 10/f259b2ddf04489da9512ad637ba6b4ef2d77abd4445d20f7f1714585f153435200a53fa6a2e4a5ee974df14ddad4cd16421f6f803e96e8b452bd48598878d0ee
+  checksum: 10/65b550f1836e3b43f512f12afbc3be96616eee5c353e16d70181b7dffec8c08beabffb51d69a3bbdb27d675840725cbab025fda9d10716b5cda7dd864dc7bc4a
   languageName: node
   linkType: hard