Build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.14 by dependabot[bot] · Pull Request #284 · github/local-action

dependabot · 2026-04-22T00:59:54Z

Bumps brace-expansion from 1.1.12 to 1.1.14.

Commits

10c05fc 1.1.14
1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
6c353ca 1.1.13
7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
See full diff in compare view

github-actions · 2026-04-22T01:03:06Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5	0	0	0.26s
✅ JAVASCRIPT	prettier	19	0	0	1.37s
✅ JSON	npm-package-json-lint	yes	no	no	2.17s
✅ JSON	prettier	29	0	0	2.99s
✅ MARKDOWN	markdownlint	10	0	0	0.89s
✅ REPOSITORY	checkov	yes	no	no	28.42s
✅ REPOSITORY	gitleaks	yes	no	no	2.61s
✅ REPOSITORY	git_diff	yes	no	no	0.02s
❌ REPOSITORY	grype	yes	4	no	65.12s
✅ REPOSITORY	secretlint	yes	no	no	1.35s
✅ REPOSITORY	syft	yes	no	no	4.31s
❌ REPOSITORY	trivy	yes	1	no	14.35s
✅ REPOSITORY	trivy-sbom	yes	no	no	4.24s
✅ REPOSITORY	trufflehog	yes	no	no	46.38s
✅ TYPESCRIPT	prettier	108	0	0	3.36s
✅ YAML	prettier	25	0	0	0.98s
✅ YAML	yamllint	25	0	0	0.63s

Detailed Issues

❌ REPOSITORY / grype - 4 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME             INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS           RISK   
lodash           4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      < 0.1% (11th)  < 0.1  
yaml             2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    < 0.1% (18th)  < 0.1  
lodash           4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    < 0.1% (7th)   < 0.1  
fast-xml-parser  5.5.7      5.7.0     npm   GHSA-gh4j-gqv2-49f6  Medium    N/A            N/A
[0065] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / trivy - 1 error

2026-05-09T02:34:53Z	INFO	[vulndb] Need to update DB
2026-05-09T02:34:53Z	INFO	[vulndb] Downloading vulnerability DB...
2026-05-09T02:34:53Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2.58 MiB / 92.41 MiB [->_____________________________________________________________] 2.79% ? p/s ?20.13 MiB / 92.41 MiB [------------->_______________________________________________] 21.78% ? p/s ?44.13 MiB / 92.41 MiB [----------------------------->_______________________________] 47.76% ? p/s ?64.78 MiB / 92.41 MiB [-------------------------------->______________] 70.10% 103.68 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [--------------------------------------------->] 100.00% 103.68 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [--------------------------------------------->] 100.00% 103.68 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 99.96 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 99.96 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 99.96 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 93.51 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 93.51 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 93.51 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 87.47 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 87.47 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 87.47 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 81.83 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 81.83 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 81.83 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 76.55 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 76.55 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 76.55 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 71.61 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 71.61 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 71.61 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 66.99 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 66.99 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 66.99 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 62.67 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [---------------------------------------------->] 100.00% 62.67 MiB p/s ETA 0s92.41 MiB / 92.41 MiB [-------------------------------------------------] 100.00% 16.31 MiB p/s 5.9s2026-05-09T02:34:59Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-05-09T02:34:59Z	INFO	[vuln] Vulnerability scanning is enabled
2026-05-09T02:34:59Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-05-09T02:34:59Z	INFO	[checks-client] Need to update the checks bundle
2026-05-09T02:34:59Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2026-05-09T02:35:06Z	INFO	Suppressing dependencies for development and testing. To display them, try the '--include-dev-deps' flag.
2026-05-09T02:35:06Z	INFO	Number of language-specific files	num=1
2026-05-09T02:35:06Z	INFO	[npm] Detecting vulnerabilities...
2026-05-09T02:35:06Z	INFO	Detected config files	num=0

Report Summary

┌───────────────────┬──────┬─────────────────┬───────────────────┐
│      Target       │ Type │ Vulnerabilities │ Misconfigurations │
├───────────────────┼──────┼─────────────────┼───────────────────┤
│ package-lock.json │ npm  │        5        │         -         │
└───────────────────┴──────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


package-lock.json (npm)
=======================
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 2, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ fast-xml-builder │ CVE-2026-44665 │ HIGH     │ fixed  │ 1.1.4             │ 1.1.7         │ fast-xml-builder allows attribute values with unwanted       │
│                  │                │          │        │                   │               │ quotes to bypass malicious or unwanted...                    │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-44665                   │
├──────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ fast-xml-parser  │ CVE-2026-41650 │ MEDIUM   │        │ 5.5.7             │ 5.7.0         │ fast-xml-parser XMLBuilder: XML Comment and CDATA Injection  │
│                  │                │          │        │                   │               │ via Unescaped Delimiters                                     │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41650                   │
├──────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ lodash           │ CVE-2026-4800  │ HIGH     │        │ 4.17.23           │ 4.18.0        │ lodash: lodash: Arbitrary code execution via untrusted input │
│                  │                │          │        │                   │               │ in template imports                                          │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-4800                    │
│                  ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-2950  │ MEDIUM   │        │                   │               │ lodash: Lodash: Prototype pollution allows deletion of       │
│                  │                │          │        │                   │               │ built-in prototype properties via array...                   │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-2950                    │
├──────────────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ yaml             │ CVE-2026-33532 │          │        │ 2.8.2             │ 2.8.3, 1.10.3 │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                  │                │          │        │                   │               │ document parsing                                             │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.70.0 of Trivy is now available, current version is 0.69.1

To suppress version checks, run Trivy scans with the --skip-version-check flag

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.14. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels Apr 22, 2026

dependabot Bot requested a review from ncalteen as a code owner April 22, 2026 00:59

dependabot Bot added the npm Node.js issues and PRs label Apr 22, 2026

dependabot Bot mentioned this pull request Apr 22, 2026

Build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13 #280

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/brace-expansion-1.1.14 branch from 5ac62ca to 4f8b106 Compare May 9, 2026 02:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.14#284

Build(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.14#284
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/brace-expansion-1.1.14

dependabot Bot commented on behalf of github Apr 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 22, 2026 •

edited

Loading

github-actions Bot commented Apr 22, 2026 •

edited

Loading