fix(docs): pin brace-expansion override to 2.0.2 to unbreak the Cloudflare docs build#6110
Conversation
…ild resolves a CJS build The pnpm override for the brace-expansion ReDoS advisory (CVE-2025-5889) used an open-ended target `>=2.0.3`, which pnpm resolves to the newest release (5.0.6). brace-expansion 3.x+ is ESM-only and exposes no default export, so [email protected] — pulled in by the @opennextjs/cloudflare adapter during the `librefang-deploy` Workers build — fails on `import expand from 'brace-expansion'` with: SyntaxError: The requested module 'brace-expansion' does not provide an export named 'default' Pin the override to the patched CJS release 2.0.2, which still satisfies the advisory and keeps a default export. Verified with [email protected]: `>=2.0.3` resolves brace-expansion 5.0.6 and reproduces the error, while `2.0.2` resolves 2.0.2 and imports cleanly.
github-actions
Bot
added
size/XS
| "picomatch@<2.3.2": ">=2.3.2", | ||
| "picomatch@>=4.0.0 <4.0.4": ">=4.0.4", | ||
| "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3", | ||
| "brace-expansion@>=2.0.0 <2.0.3": "2.0.2", |
There was a problem hiding this comment.
The override selector key still reads brace-expansion@>=2.0.0 <2.0.3, which classifies 2.0.2 as part of the vulnerable range (it satisfies >=2.0.0 <2.0.3). Setting the target to 2.0.2 while the key declares that version vulnerable is a contradiction that needs clarification.
Two possible truths:
-
2.0.3was never published —>=2.0.3always resolved to the ESM-only 3.x/5.x line, and2.0.2is the actual CVE-2025-5889-patched release. If so, this fix is correct, but the selector key should also be tightened to<2.0.2(or removed) so the override accurately reflects the vulnerable boundary. Leaving<2.0.3in the key while targeting2.0.2means packages that already resolved to the safe2.0.2will be caught by the override and "forced" to2.0.2— a no-op, but it misleads future readers about what version is actually unsafe. -
2.0.3exists and is the patched release — In that case, pinning to2.0.2re-introduces CVE-2025-5889 and the target should be2.0.3(not>=2.0.3, to stay on CJS).
Could you confirm which scenario applies (e.g., link to the advisory or npm view brace-expansion versions) and, if it's scenario 1, also update the selector key to <2.0.2? That will make the override internally consistent and correct for the next person who reads it.
Generated by Claude Code
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
librefang-deploy | c912b56 | Jun 14 2026, 11:47 PM |
1 participant
Type
Summary
The
librefang-deployCloudflare Workers build (which builds thedocs/Next.js site via the
@opennextjs/cloudflareadapter) has been failing onmainand therefore on every PR built on top of it.Root cause is the pnpm override added for the brace-expansion ReDoS advisory
(CVE-2025-5889):
The target
>=2.0.3is open-ended, so pnpm resolves it to the newest release(
5.0.6). brace-expansion 3.x+ is ESM-only and exposes nodefaultexport,while
[email protected]— pulled in transitively by the OpenNext adapter —does
import expand from 'brace-expansion'. The build dies with:Fix
Pin the override to the patched CJS release
2.0.2. It still satisfies theadvisory (the fix landed in 2.0.2) and keeps the CommonJS default-export
interop that
[email protected]relies on. Diff is two lines (package.json +the lockfile
overridessection); no other dependencies change.Verification
Reproduced and verified with
[email protected](the version pinned indocs/package.jsonpackageManager):import minimatch>=2.0.3(before)5.0.6defaultexport2.0.2(after)2.0.2Security