Advisory
GHSA-mh99-v99m-4gvg — brace-expansion: DoS via unbounded expansion length (CWE-400/770), high. Vulnerable range <= 5.0.7, patched 5.0.8.
Where it comes from
Transitive, build/dev-time only:
eslint, @eslint/config-array, @eslint/eslintrc, eslint-plugin-jsx-a11y → minimatch@3.1.5 → brace-expansion@1.1.16vite-plugin-pwa → workbox-build → … → filelist → brace-expansion
None of these ship in the client bundle.
Fix attempted
Added an override bumping the one instance on a maintained ESM branch (brace-expansion 5.0.7 → 5.0.8). The remaining flagged copies are brace-expansion@1.1.16, pulled by minimatch@3.1.5 (CommonJS, require()s brace-expansion). The only version npm audit accepts (5.0.8) is ESM-only ("type": "module"), so forcing it there breaks minimatch@3's require() and therefore ESLint. The advisory carries a single consolidated range (<= 5.0.7) with no per-branch patch, so the maintained 1.x line is false-flagged.
Why it does not affect StellarForge
The DoS requires expanding an attacker-controlled brace pattern of enormous length. These tools only ever process first-party input at build time — ESLint config globs and our own source paths, PWA template/manifest globbing. No untrusted input reaches them, and none run at request time in the shipped app.
Upgrade path (removes the waiver)
When eslint/eslint-plugin-jsx-a11y move to a minimatch major that depends on brace-expansion >= 5.0.8 (or ships ESM), drop the waiver.
Waived in frontend/audit-ci.jsonc with a Review-by of 2026-10-27.
Advisory
GHSA-mh99-v99m-4gvg — brace-expansion: DoS via unbounded expansion length (CWE-400/770), high. Vulnerable range
<= 5.0.7, patched5.0.8.Where it comes from
Transitive, build/dev-time only:
eslint,@eslint/config-array,@eslint/eslintrc,eslint-plugin-jsx-a11y→minimatch@3.1.5→brace-expansion@1.1.16vite-plugin-pwa→workbox-build→ … →filelist→brace-expansionNone of these ship in the client bundle.
Fix attempted
Added an override bumping the one instance on a maintained ESM branch (
brace-expansion 5.0.7 → 5.0.8). The remaining flagged copies arebrace-expansion@1.1.16, pulled byminimatch@3.1.5(CommonJS,require()s brace-expansion). The only version npm audit accepts (5.0.8) is ESM-only ("type": "module"), so forcing it there breaksminimatch@3'srequire()and therefore ESLint. The advisory carries a single consolidated range (<= 5.0.7) with no per-branch patch, so the maintained1.xline is false-flagged.Why it does not affect StellarForge
The DoS requires expanding an attacker-controlled brace pattern of enormous length. These tools only ever process first-party input at build time — ESLint config globs and our own source paths, PWA template/manifest globbing. No untrusted input reaches them, and none run at request time in the shipped app.
Upgrade path (removes the waiver)
When
eslint/eslint-plugin-jsx-a11ymove to aminimatchmajor that depends onbrace-expansion >= 5.0.8(or ships ESM), drop the waiver.Waived in
frontend/audit-ci.jsoncwith a Review-by of 2026-10-27.