boardgameio / boardgame.io / 30202137208

100%

master: 100%

push

github

fix(deps): patch transitive brace-expansion DoS alerts (#1288)

Dependabot's security update fails on this repo because it only considers
the `latest` dist-tag (5.0.8) and cannot bridge 1.x -> 5.x in place. The
maintainers backported the fix to both maintenance lines, so range-scoped
overrides patch it without a major jump.

Only minimatch consumes brace-expansion here, and each line needs its own
major: minimatch@3 -> 1.x, minimatch@8/9 -> 2.x, minimatch@10 -> 5.x.
A blanket override to 5.x would break the first three.

- brace-expansion 1.1.15 -> 1.1.16 (GHSA-3jxr-9vmj-r5cp, high)
- brace-expansion 2.1.1 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp, high)

Overrides go in pnpm-workspace.yaml, where this repo keeps its pnpm
settings since #1273.

2041 of 2041 branches covered (100.0%)

Branch coverage included in aggregate %.

2919 of 2919 relevant lines covered (100.0%)

26326.91 hits per line