From 94408ab3bfae5acaffe0933060a2ad49341adf31 Mon Sep 17 00:00:00 2001 From: Yogendra Shelke Date: Wed, 28 Oct 2026 15:00:34 +0530 Subject: [PATCH] chore: bump brace-expansion to version 5.0.12 to address security vulnerability --- package.json | 1 + .../jsActions/mobile-resources-native/CHANGELOG.md | 1 + .../jsActions/nanoflow-actions-native/CHANGELOG.md | 1 + pnpm-lock.yaml | 11 ++++++----- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index d96a3d6f2..a611ff2dc 100644 --- a/package.json +++ b/package.json @@ -95,6 +95,7 @@ "rollup": "4.30.1", "react-test-renderer": "19.2.3", "@xmldom/xmldom": ">=0.8.13", + "brace-expansion": "5.0.12", "flatted": ">=3.4.2", "immutable": ">=5.1.5", "minimatch": ">=3.1.4", diff --git a/packages/jsActions/mobile-resources-native/CHANGELOG.md b/packages/jsActions/mobile-resources-native/CHANGELOG.md index d45eb246a..5d02d24fd 100644 --- a/packages/jsActions/mobile-resources-native/CHANGELOG.md +++ b/packages/jsActions/mobile-resources-native/CHANGELOG.md @@ -19,6 +19,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Fixed an issue where the `TakePicture` and `TakePictureAdvanced` actions failed to capture photos on Android. - Fixed an issue where the `TakePicture` and `TakePictureAdvanced` actions did not properly clean up temporary files. - Replaced @notifee/react-native with react-native-notify-kit library. +- We bumped the `brace-expansion` package to v5.0.12 to fix a denial-of-service vulnerability. ### Added diff --git a/packages/jsActions/nanoflow-actions-native/CHANGELOG.md b/packages/jsActions/nanoflow-actions-native/CHANGELOG.md index 0b6aa7ae3..5be064241 100644 --- a/packages/jsActions/nanoflow-actions-native/CHANGELOG.md +++ b/packages/jsActions/nanoflow-actions-native/CHANGELOG.md @@ -20,6 +20,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ### Changed - Migrated the geolocation actions from `@react-native-community/geolocation` to `react-native-nitro-geolocation`. +- We bumped the `brace-expansion` package to v5.0.12 to fix a denial-of-service vulnerability. ## [7.2.0] Nanoflow Commons - 2026-7-3 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f39eab86b..1721d7362 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -20,6 +20,7 @@ overrides: rollup: 4.30.1 react-test-renderer: 19.2.3 '@xmldom/xmldom': '>=0.8.13' + brace-expansion: 5.0.12 flatted: '>=3.4.2' immutable: '>=5.1.5' minimatch: '>=3.1.4' @@ -3513,9 +3514,9 @@ packages: resolution: {integrity: sha512-PyJxiNtA5T2PlLIeBot4lbp7rj4OadzjnMZD/G5zuBNt8ei/yCU7+wW0h2bag9vr8c+/WuRWmSxbqAl9hL1rBA==} engines: {node: '>= 5.10.0'} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -11061,7 +11062,7 @@ snapshots: big-integer: 1.6.52 optional: true - brace-expansion@5.0.6: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -13908,7 +13909,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.12 minimist@1.2.8: {}