From 79480e0ccf9040f6cb6b6f31dcdc4c6afa4416fb Mon Sep 17 00:00:00 2001
From: arc <224894192+arc0btc@users.noreply.github.com>
Date: Mon, 20 Jul 2026 21:31:26 -0600
Subject: [PATCH] fix(deps): patch brace-expansion DoS (CVE-2026-13149)

Adds scoped overrides for the four transitive brace-expansion instances
pulled in via minimatch/glob/@node-minify/core/typescript-estree, each
bumped to its patched release within the same major (1.1.16, 2.1.2,
5.0.7) to avoid an unintended major-version jump across consumers.

Fixes GHSA-3jxr-9vmj-r5cp / dependabot alert #134.
---
 package-lock.json | 24 ++++++++++++------------
 package.json      | 22 +++++++++++++++++++++-
 2 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1538c3a3..9ede86b3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3067,9 +3067,9 @@
       }
     },
     "node_modules/@node-minify/core/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -5520,9 +5520,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6410,9 +6410,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8589,9 +8589,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
diff --git a/package.json b/package.json
index 1259740f..e0b635fe 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,27 @@
     "picomatch": ">=4.0.4",
     "path-to-regexp": ">=8.4.0",
     "axios": ">=1.17.0",
-    "ws": ">=8.21.0"
+    "ws": ">=8.21.0",
+    "minimatch": {
+      "brace-expansion": "1.1.16"
+    },
+    "@node-minify/core": {
+      "glob": {
+        "minimatch": {
+          "brace-expansion": "2.1.2"
+        }
+      }
+    },
+    "@typescript-eslint/typescript-estree": {
+      "minimatch": {
+        "brace-expansion": "2.1.2"
+      }
+    },
+    "glob": {
+      "minimatch": {
+        "brace-expansion": "5.0.7"
+      }
+    }
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260212.0",