Files
actual/upcoming-release-notes
tabedzki ddee2cca98 [AI] fix: bump brace-expansion to resolve HIGH CVEs (#9179)
Refresh yarn.lock with `yarn up -R brace-expansion` so the 2.x range
(^2.0.1, ^2.0.2, pulled in via minimatch@5/9 and shipped in the
sync-server image through migrate) resolves to 2.1.7 instead of 2.0.3.
This clears CVE-2026-13149, CVE-2026-14257, CVE-2026-69152,
CVE-2026-102276 and CVE-2026-102278. The 5.x range moves from 5.0.5 to
5.0.12 as part of the same refresh; 1.x is already at the latest 1.1.21.

No resolutions override is needed; both versions are in range of the
existing specifiers. Fixes #9166.

Assisted-by: ClaudeCode:claude-opus-5-5
2026-10-11 20:27:29 +00:00
..

See the Writing Good Release Notes section of the README for the documentation repo for more information on how to create a release notes file here.