From 7a6bf8ccdd68d6cd547f1da80d8030545d8c20a6 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 1 Oct 2026 17:02:05 +1000 Subject: [PATCH] UID2-8003: preventive upgrade for CVE-2026-102276: brace-expansion 5.0.9 -> 5.0.10 brace-expansion@5 was already pinned to 5.0.9 via an existing `overrides` entry in each of the 7 web-integrations subproject package.json files; I bumped each to the lowest fixed version 5.0.10 (matching existing override style/ordering) and regenerated each package-lock.json with `npm install --package-lock-only`. All 7 lockfiles now resolve brace-expansion to 5.0.10 and Trivy no longer reports CVE-2026-102276 (verified: 0 occurrences). The manifests are not at the repo root; the root package.json has no brace-expansion override and no lockfile brace-expansion node, so it was left unchanged. npm 11.19.0 was used (not the stalled 10.5.0), so no npm@10.9.9 workaround was needed. Not affected in the assessed configuration; preventive update. --- .../client-server/package-lock.json | 7 +++--- .../client-server/package.json | 2 +- .../react-client-side/package-lock.json | 24 ++++--------------- .../react-client-side/package.json | 2 +- .../server-side/package-lock.json | 7 +++--- .../server-side/package.json | 2 +- .../client-server/package-lock.json | 7 +++--- .../javascript-sdk/client-server/package.json | 2 +- .../react-client-side/package-lock.json | 24 ++++--------------- .../react-client-side/package.json | 2 +- .../client-server/package-lock.json | 7 +++--- .../client-server/package.json | 2 +- .../server-side/package-lock.json | 7 +++--- web-integrations/server-side/package.json | 2 +- 14 files changed, 35 insertions(+), 62 deletions(-) diff --git a/web-integrations/google-secure-signals/client-server/package-lock.json b/web-integrations/google-secure-signals/client-server/package-lock.json index ec91a5a..1aa61b6 100644 --- a/web-integrations/google-secure-signals/client-server/package-lock.json +++ b/web-integrations/google-secure-signals/client-server/package-lock.json @@ -673,9 +673,10 @@ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==" }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, diff --git a/web-integrations/google-secure-signals/client-server/package.json b/web-integrations/google-secure-signals/client-server/package.json index 3d68743..52c4512 100644 --- a/web-integrations/google-secure-signals/client-server/package.json +++ b/web-integrations/google-secure-signals/client-server/package.json @@ -28,7 +28,7 @@ "picomatch": "^2.3.2", "@babel/plugin-transform-modules-systemjs": ">=7.29.4", "fast-uri": ">=3.1.2", - "brace-expansion@5": "5.0.9", + "brace-expansion@5": "5.0.10", "js-yaml@3": "3.15.0" }, "devDependencies": { diff --git a/web-integrations/google-secure-signals/react-client-side/package-lock.json b/web-integrations/google-secure-signals/react-client-side/package-lock.json index 0b3eab4..05c5b49 100644 --- a/web-integrations/google-secure-signals/react-client-side/package-lock.json +++ b/web-integrations/google-secure-signals/react-client-side/package-lock.json @@ -5344,10 +5344,11 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, @@ -16463,23 +16464,6 @@ } } }, - "node_modules/tailwindcss/node_modules/yaml": { - "version": "2.9.1", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", - "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", - "dev": true, - "optional": true, - "peer": true, - "bin": { - "yaml": "bin.mjs" - }, - "engines": { - "node": ">= 14.6" - }, - "funding": { - "url": "https://github.com/sponsors/eemeli" - } - }, "node_modules/tapable": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz", diff --git a/web-integrations/google-secure-signals/react-client-side/package.json b/web-integrations/google-secure-signals/react-client-side/package.json index 656ad3b..01f498d 100644 --- a/web-integrations/google-secure-signals/react-client-side/package.json +++ b/web-integrations/google-secure-signals/react-client-side/package.json @@ -43,7 +43,7 @@ "shell-quote": "1.9.0", "ws": ">=7.5.11", "websocket-driver": "^0.7.5", - "brace-expansion@5": "5.0.9", + "brace-expansion@5": "5.0.10", "js-yaml@3": "3.15.0", "js-yaml@4": "4.3.0" }, diff --git a/web-integrations/google-secure-signals/server-side/package-lock.json b/web-integrations/google-secure-signals/server-side/package-lock.json index 8793bc8..f2d6882 100644 --- a/web-integrations/google-secure-signals/server-side/package-lock.json +++ b/web-integrations/google-secure-signals/server-side/package-lock.json @@ -784,9 +784,10 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, diff --git a/web-integrations/google-secure-signals/server-side/package.json b/web-integrations/google-secure-signals/server-side/package.json index f94d906..24cc96d 100644 --- a/web-integrations/google-secure-signals/server-side/package.json +++ b/web-integrations/google-secure-signals/server-side/package.json @@ -30,7 +30,7 @@ "picomatch": "^2.3.2", "@babel/plugin-transform-modules-systemjs": ">=7.29.4", "fast-uri": ">=3.1.2", - "brace-expansion@5": "5.0.9", + "brace-expansion@5": "5.0.10", "js-yaml@3": "3.15.0" }, "devDependencies": { diff --git a/web-integrations/javascript-sdk/client-server/package-lock.json b/web-integrations/javascript-sdk/client-server/package-lock.json index 6a27609..967ddc7 100644 --- a/web-integrations/javascript-sdk/client-server/package-lock.json +++ b/web-integrations/javascript-sdk/client-server/package-lock.json @@ -783,9 +783,10 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, diff --git a/web-integrations/javascript-sdk/client-server/package.json b/web-integrations/javascript-sdk/client-server/package.json index c1ff990..520e71a 100644 --- a/web-integrations/javascript-sdk/client-server/package.json +++ b/web-integrations/javascript-sdk/client-server/package.json @@ -36,7 +36,7 @@ "@babel/plugin-transform-modules-systemjs": ">=7.29.4", "fast-uri": ">=3.1.2", "form-data": ">=4.0.6", - "brace-expansion@5": "5.0.9", + "brace-expansion@5": "5.0.10", "js-yaml@3": "3.15.0" }, "resolutions": { diff --git a/web-integrations/javascript-sdk/react-client-side/package-lock.json b/web-integrations/javascript-sdk/react-client-side/package-lock.json index bc46dcf..c03cba3 100644 --- a/web-integrations/javascript-sdk/react-client-side/package-lock.json +++ b/web-integrations/javascript-sdk/react-client-side/package-lock.json @@ -5325,10 +5325,11 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, @@ -16430,23 +16431,6 @@ } } }, - "node_modules/tailwindcss/node_modules/yaml": { - "version": "2.9.1", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", - "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", - "dev": true, - "optional": true, - "peer": true, - "bin": { - "yaml": "bin.mjs" - }, - "engines": { - "node": ">= 14.6" - }, - "funding": { - "url": "https://github.com/sponsors/eemeli" - } - }, "node_modules/tapable": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz", diff --git a/web-integrations/javascript-sdk/react-client-side/package.json b/web-integrations/javascript-sdk/react-client-side/package.json index e6725e7..38123e4 100644 --- a/web-integrations/javascript-sdk/react-client-side/package.json +++ b/web-integrations/javascript-sdk/react-client-side/package.json @@ -43,7 +43,7 @@ "shell-quote": "1.9.0", "ws": ">=7.5.11", "websocket-driver": "^0.7.5", - "brace-expansion@5": "5.0.9", + "brace-expansion@5": "5.0.10", "js-yaml@3": "3.15.0", "js-yaml@4": "4.3.0" }, diff --git a/web-integrations/prebid-integrations/client-server/package-lock.json b/web-integrations/prebid-integrations/client-server/package-lock.json index a5e03da..a739c54 100644 --- a/web-integrations/prebid-integrations/client-server/package-lock.json +++ b/web-integrations/prebid-integrations/client-server/package-lock.json @@ -93,9 +93,10 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, diff --git a/web-integrations/prebid-integrations/client-server/package.json b/web-integrations/prebid-integrations/client-server/package.json index a955044..52d327b 100644 --- a/web-integrations/prebid-integrations/client-server/package.json +++ b/web-integrations/prebid-integrations/client-server/package.json @@ -26,6 +26,6 @@ "flatted": "^3.4.2", "path-to-regexp": "^8.4.0", "form-data": ">=4.0.6", - "brace-expansion@5": "5.0.9" + "brace-expansion@5": "5.0.10" } } diff --git a/web-integrations/server-side/package-lock.json b/web-integrations/server-side/package-lock.json index 68a36c0..38b9c08 100644 --- a/web-integrations/server-side/package-lock.json +++ b/web-integrations/server-side/package-lock.json @@ -597,9 +597,10 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.10", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", + "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, diff --git a/web-integrations/server-side/package.json b/web-integrations/server-side/package.json index 6613893..50fe6df 100644 --- a/web-integrations/server-side/package.json +++ b/web-integrations/server-side/package.json @@ -34,7 +34,7 @@ "node-forge": "^1.4.0", "picomatch": "^2.3.2", "form-data": ">=4.0.6", - "brace-expansion@5": "5.0.9", + "brace-expansion@5": "5.0.10", "js-yaml@3": "3.15.0" }, "resolutions": {