actualbudget/actual
1
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-10-11 22:49:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
actual/upcoming-release-notes/bump-brace-expansion.md
T
tabedzki ddee2cca98 [AI] fix: bump brace-expansion to resolve HIGH CVEs (#9179) 
Refresh yarn.lock with `yarn up -R brace-expansion` so the 2.x range
(^2.0.1, ^2.0.2, pulled in via minimatch@5/9 and shipped in the
sync-server image through migrate) resolves to 2.1.7 instead of 2.0.3.
This clears CVE-2026-13149, CVE-2026-14257, CVE-2026-69152,
CVE-2026-102276 and CVE-2026-102278. The 5.x range moves from 5.0.5 to
5.0.12 as part of the same refresh; 1.x is already at the latest 1.1.21.

No resolutions override is needed; both versions are in range of the
existing specifiers. Fixes #9166.

Assisted-by: ClaudeCode:claude-opus-5-5
2026-10-11 20:27:29 +00:00

162 B
Raw Permalink Blame History

category, authors
category authors
Maintenance
tabedzki

Update brace-expansion to 2.1.7 and 5.0.12 to address security advisories reported against the server image.

Reference in New Issue View Git Blame Copy Permalink