Skip to content

fix(deps): bump shell-quote, brace-expansion and joi - #301

Merged
luca-gr4vy merged 1 commit into
mainfrom
fix/shell-quote-brace-expansion-joi-vulns
Oct 12, 2026
Merged

luca-gr4vy merged 1 commit into
mainfrom
fix/shell-quote-brace-expansion-joi-vulns

Conversation

@luca-gr4vy

@luca-gr4vy luca-gr4vy commented Oct 12, 2026 •

Copy link
Copy Markdown
Collaborator

Fixes the trivy failure on https://github.com/gr4vy/gr4vy-react-native/actions/runs/38194409023/job/114633819591 and open dependabot alerts.

Changes (lockfile only, within existing semver ranges)

  • shell-quote 1.9.0 → 1.11.0 (example + root): CVE-2026-102422, CRITICAL
  • brace-expansion → 1.1.21 / 2.1.7 / 5.0.12: dependabot alerts 299, 300, 304, 305
  • joi 17.13.4 → 17.13.8 (example): dependabot alerts 279, 280

No new deps, no package.json changes. yarn install --frozen-lockfile OK; local trivy: 0 vulns in both lockfiles.

Not fixed

  • braces <= 3.0.3 (alert 301): no upstream patch. Suggest dismissing the alert.

🤖 Generated with Claude Code

- shell-quote 1.9.0 -> 1.11.0 (CVE-2026-102422, trivy)
- brace-expansion 1.1.16 -> 1.1.21, 2.1.0 -> 2.1.7, 5.0.8 -> 5.0.12 (dependabot #299, #300, #304, #305)
- joi 17.13.4 -> 17.13.8 in example (dependabot #279, #280)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Copilot AI balanced review requested due to automatic review settings October 12, 2026 07:24

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@luca-gr4vy luca-gr4vy added internal Changes only affect the internal API dependencies Update one or more dependencies version vulnerability labels Oct 12, 2026
@luca-gr4vy
luca-gr4vy merged commit bdde7a4 into main Oct 12, 2026
4 checks passed
@luca-gr4vy
luca-gr4vy deleted the fix/shell-quote-brace-expansion-joi-vulns branch October 12, 2026 07:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Update one or more dependencies version internal Changes only affect the internal API vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants