Bump brace-expansion from 1.1.8 to 1.1.18 in /fixtures/expiration by dependabot[bot] · Pull Request #402 · Rashdamada/react

dependabot · 2026-08-08T21:35:16Z

Bumps brace-expansion from 1.1.8 to 1.1.18.

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

v1.1.11

brace-expansion

Brace expansion, as known from sh/bash, in JavaScript.

Example
var expand = require('brace-expansion');
expand('file-{a,b,c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('-v{,,}')
// => ['-v', '-v', '-v']
expand('file{0..2}.jpg')
// => ['file0.jpg', 'file1.jpg', 'file2.jpg']
expand('file-{a..c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('file{2..0}.jpg')
// => ['file2.jpg', 'file1.jpg', 'file0.jpg']
expand('file{0..4..2}.jpg')
// => ['file0.jpg', 'file2.jpg', 'file4.jpg']
</tr></table>

... (truncated)

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.8 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.8...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

martinSaad · 2026-08-08T21:35:35Z

⛔ Snyk checks have failed. 437 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (437)
⛔	Open Source Security	28	260	127	22	437 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2026-08-08T21:36:10Z

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

karencapiiro · 2026-08-08T21:47:00Z

Checkmarx One – Scan Summary & Details – 497c4921-25e7-4791-8a45-936d52705f97

New Issues (534)

Critical: 47 · High: 266 · Medium: 180 · Low: 41

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	CVE-2026-0905	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Insufficient policy enforcement in the Network in Google Chrome prior to 144.0.7559.59 allowed an attacker who obtained a network log file to poten... Attack Vector: NETWORK Attack Complexity: LOW `ID: A3ULyk7NnbwVqY%2BhVnq9%2F8kyzjnnhQ6hardMnE8Gx2Q%3D` Vulnerable Package
2	CVE-2026-0906	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) ... Attack Vector: NETWORK Attack Complexity: LOW `ID: %2Bo3TWDplpTgO1BXvq%2FWtfM47BqUOPgzw%2BGrT4wetoGQ%3D` Vulnerable Package
3	CVE-2026-0907	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: LOW `ID: 2U7vxDurOTiWdc8el%2B7b3bhfWxAgxQ3h2TKnpwX8sLw%3D` Vulnerable Package
4	CVE-2026-11671	Npm-electron-23.1.2	details Recommended version: 40.10.5 Description: Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a craft... Attack Vector: NETWORK Attack Complexity: LOW `ID: TKLOASzEwwwqjT7lWP%2FCTWDa%2BgtnE7UG46sWjHyuqdk%3D` Vulnerable Package
5	CVE-2026-1525	Npm-undici-5.22.1	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW `ID: AKeKuvPrdDUU%2BHh6%2FF8uW7VEktwiRQShwi4e34ze0R8%3D` Vulnerable Package
6	CVE-2026-1525	Npm-undici-5.20.0	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW `ID: p0MlY11YAigbm5UGVe31yuNQqXnnDORuutu%2FOWjv4Eo%3D` Vulnerable Package
7	CVE-2026-3061	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafte... Attack Vector: NETWORK Attack Complexity: LOW `ID: i%2F%2Fc3nCUCagulsRqQNNaKo0WuqMkXjjdRPOtTx986Xs%3D` Vulnerable Package
8	CVE-2026-3062	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory acce... Attack Vector: NETWORK Attack Complexity: LOW `ID: l1IBPRfF3R0DLE2Bow1BCCZXLQnbxWxNDRiu%2BFrXLUg%3D` Vulnerable Package
9	CVE-2026-33896	Npm-node-forge-0.7.6	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: MiFqY2YBEgzOAK3Uhb%2FE%2F1d9gLCaB1%2FLTQXjVmGIZdc%3D` Vulnerable Package
10	CVE-2026-33896	Npm-node-forge-1.3.1	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: BdlNtT6sSkoyO050QIELOkWIXpSXBg3UWr4Hl1DwSjU%3D` Vulnerable Package
11	CVE-2026-33896	Npm-node-forge-0.10.0	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: zA6%2FleD8HqlGm0ZM50jl04NLbMqmb1%2BnkXC5rOyHO2E%3D` Vulnerable Package
12	CVE-2026-33896	Npm-node-forge-0.6.33	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: nO2W8QzFSHn5Z6u9uIDdmTC7oIGnsxX8KNNb6R0RBIg%3D` Vulnerable Package
13	CVE-2026-33937	Npm-handlebars-4.5.3	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: tJRz9y89U%2FzR95%2FiN4U3KtDN8QpdemVHMOOq9cUGFiU%3D` Vulnerable Package
14	CVE-2026-33937	Npm-handlebars-4.7.7	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: Kzh3PAL4Bo95jWpMPLyr6XYVxqIuX50JW8nDybV9848%3D` Vulnerable Package
15	CVE-2026-33937	Npm-handlebars-4.7.6	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: PciHR3V04ee3ci2JKXfVo57GWy%2B6D5BX6%2FlrwG6RXSk%3D` Vulnerable Package
16	CVE-2026-34775	Npm-electron-23.1.2	details Recommended version: 38.8.6 Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39.... Attack Vector: NETWORK Attack Complexity: LOW `ID: p1e7yiwN7vmvdOdfYEMjw8n2JrPhZ8cZuspg%2FMuAB%2Fw%3D` Vulnerable Package
17	CVE-2026-3545	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox esca... Attack Vector: NETWORK Attack Complexity: LOW `ID: Zd0h9MAWzK8dhd1qifIcHa7Y1Sourtn%2B1S37XKlXjFE%3D` Vulnerable Package
18	CVE-2026-3916	Npm-electron-23.1.2	details Recommended version: 41.0.1 Description: Out-of-bounds Read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a cr... Attack Vector: NETWORK Attack Complexity: LOW `ID: fOx3bGv2MCuErS1y2Z%2FziWDoFMoOQZQuT17zeSkhesc%3D` Vulnerable Package
19	CVE-2026-45623	Npm-postcss-8.4.35	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: xrToxNiHcxUzsg%2FrMOtaI%2Fv5ZS%2FKCbU41p8h0i0Ah4k%3D` Vulnerable Package
20	CVE-2026-45623	Npm-postcss-6.0.9	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: hlJpvgtVCwhX%2F672OeKEQuJ9y%2B7OO5FPhC4gxayo2sI%3D` Vulnerable Package
21	CVE-2026-45623	Npm-postcss-7.0.32	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: Grfo1Cnp1oeKBPDL4%2Fen98W91d8pOIvOVrdq4hFSOJc%3D` Vulnerable Package
22	CVE-2026-45623	Npm-postcss-7.0.39	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: IaPSl0qmb3WGkYTicTj6Eotydoz1Kwa%2FuEBCo54Njhc%3D` Vulnerable Package
23	CVE-2026-45623	Npm-postcss-8.4.16	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: 4Tz%2Bn%2BxgcALwaizu7tyIBsbRHTSz4F%2F4kxIs6EEWx7o%3D` Vulnerable Package
24	CVE-2026-45623	Npm-postcss-6.0.14	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: S0H9hNxZ3KX%2FRd7UXVor95tTN3cMIVRyHL4%2FqHQJcdI%3D` Vulnerable Package
25	CVE-2026-45623	Npm-postcss-6.0.23	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: r4DVz1R8qC4xFhDM0%2FxWPsfO7UtcXN1jSdUrm1XhhKc%3D` Vulnerable Package
26	CVE-2026-45623	Npm-postcss-5.2.18	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: iSAUNaubRNzYxt5Tky1hZK9i9TyncbMfWLKLid1Cr2s%3D` Vulnerable Package
27	CVE-2026-45623	Npm-postcss-5.2.17	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: 59ffIT2LozRut5hdyRgteRc8uuxntd9eJQTW1sRnOzY%3D` Vulnerable Package
28	CVE-2026-45623	Npm-postcss-5.2.15	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: Ljz2VfdSUqdWZhnbOa1lsHcjyVR75rIe6zJsrxkGBYQ%3D` Vulnerable Package
29	CVE-2026-4800	Npm-lodash-4.17.15	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: KYWvkw100snPweeftyqDWjhEyNqbvYpVpdn9cemuUls%3D` Vulnerable Package
30	CVE-2026-4800	Npm-lodash-4.17.20	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: DSad4nJJxGiZRtdW8Yxy63hIfNWu93LYtTK8jxHEHpU%3D` Vulnerable Package
31	CVE-2026-4800	Npm-lodash-4.17.4	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: rzJknYA7E2jaEeyGGaYFEckJfRWIf6R%2BAjosVGti4gc%3D` Vulnerable Package
32	CVE-2026-4800	Npm-lodash-4.17.11	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: TpGlH7BTN2QdbPLX26CuEZKIDrj%2B%2FYlKEDJijn699Ns%3D` Vulnerable Package
33	CVE-2026-4800	Npm-lodash-4.17.21	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: %2BTO3uFKrXlH0PqApgBULAXkRsdb%2Ff55qvO5CM2xBJug%3D` Vulnerable Package
34	CVE-2026-5288	Npm-electron-23.1.2	details Recommended version: 41.2.0 Description: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to... Attack Vector: NETWORK Attack Complexity: LOW `ID: Q9pl2emonc9pKEiTGJgecu%2Fip647oHwqxRjSAYG86Lo%3D` Vulnerable Package
35	CVE-2026-53486	Npm-decompress-4.2.1	details Description: When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes th... Attack Vector: NETWORK Attack Complexity: LOW `ID: cbw5V5oVFlORa%2Ftr4Yp9SFB%2BxU7Gbe%2B99KpzRX4GIDg%3D` Vulnerable Package
36	CVE-2026-54466	Npm-websocket-driver-0.7.3	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: fSQb9sJI9WE67HTpJ5wO1OE1loPdnEdZOViVH%2BlfXWY%3D` Vulnerable Package
37	CVE-2026-54466	Npm-websocket-driver-0.7.4	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: tv7LUIsbaHKX1v2LGQTJoDMzQG93lQCYD%2BOF1z0e5lA%3D` Vulnerable Package
38	CVE-2026-54466	Npm-websocket-driver-0.6.5	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: Bg2aNIVYpU7eIIM2w00rh4%2F22YKISg%2BArwbbaxwAbLc%3D` Vulnerable Package
39	CVE-2026-54466	Npm-websocket-driver-0.7.0	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: r5yTA74dzLFvwB%2F8Qu6HO5oH18zAcvg7vHHVMcc8dmM%3D` Vulnerable Package
40	CVE-2026-59873	Npm-tar-2.2.2	details Recommended version: 7.5.19 Description: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data... Attack Vector: NETWORK Attack Complexity: LOW `ID: pBqknF2OS5bYbyftPutgwe%2Fwmc%2FSeDK3BFaL5jRqfcM%3D` Vulnerable Package

More results are available on the CxOne platform

Fixed Issues (5)

Medium: 5

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2025-13466~~	Npm-body-parser-1.18.2
	~~CVE-2025-13466~~	Npm-body-parser-1.19.0
	~~CVE-2025-13466~~	Npm-body-parser-1.20.1
	~~CVE-2025-13466~~	Npm-body-parser-1.19.2
	~~CVE-2025-13466~~	Npm-body-parser-1.20.2

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 8, 2026

Navigation Menu

Uh oh!

Bump brace-expansion from 1.1.8 to 1.1.18 in /fixtures/expiration - #402

Bump brace-expansion from 1.1.8 to 1.1.18 in /fixtures/expiration#402
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fixtures/expiration/brace-expansion-1.1.18

dependabot Bot commented on behalf of github Aug 8, 2026

Uh oh!

martinSaad commented Aug 8, 2026

Uh oh!

socket-security Bot commented Aug 8, 2026

Uh oh!

karencapiiro commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 8, 2026

v1.1.15

v1.1.12

v1.1.11

brace-expansion

Example

Uh oh!

martinSaad commented Aug 8, 2026

⛔ Snyk checks have failed. 437 issues have been found so far.

Uh oh!

socket-security Bot commented Aug 8, 2026

Uh oh!

karencapiiro commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants