fix(deps): brace-expansion 钉到 5.0.12（CVE-2026-102276/102277/102278） by modusensus · Pull Request #345 · slow-stack/mneme

modusensus · 2026-09-30T11:10:16Z

问题

osv-scanner 在 main（commit 8519f57）上报出三条告警，全部落在同一个包 [email protected]：

#	严重度	CVE	类型
7	high	CVE-2026-102276	栈耗尽 DoS（`parseCommaParts` 无界递归 + `push.apply` 大数组）
8	medium	CVE-2026-102277	二次时间 CPU DoS（`{a},b}` 重写循环）
9	high	CVE-2026-102278	栈耗尽 DoS（嵌套花括号递归）

三条都是可用性问题，不涉及代码执行或数据泄露。

影响面：实际打不着

该包只经开发依赖进入本项目：

c8@12（覆盖率工具，devDependency）
└─ [email protected]
   └─ [email protected]
      └─ [email protected]

npm ls --omit=dev 为空 —— 生产依赖树里没有它
package.json 的 dependencies 只有 morphicons
发布产物的 files 不含 lockfile

所以安装本插件的用户拿不到这段代码。而触发这三个洞都需要把一个精心构造的恶意字符串当作 glob 模式喂给 expand()；在 c8 里这个字符串来自项目自己的覆盖率配置，不是外部可控输入。

结论：真实风险≈0，但三条告警会一直挂在 Security 页面。

改动

按仓库既有做法（adm-zip 就是走 overrides 钉版本的）加一条：

"overrides": {
  "adm-zip": "0.6.1",
  "brace-expansion": "5.0.12"
}

5.0.12 是三个洞修复版里最高的那个（分别修在 5.0.10 / 5.0.11 / 5.0.12），一版全清。minimatch 声明的是 ^5.0.8，所以不需要动其它依赖。

改动规模：package.json +2/−1，package-lock.json +3/−3。

验证

$ npm ls brace-expansion --all
`-- [email protected]
  `-- [email protected]
    `-- [email protected]
      `-- [email protected] overridden

测试 1437 项：1436 通过 / 0 失败 / 1 跳过。

合并进 main 后，osv-scanner 会在 push 时重扫，这三条告警应自动转为 fixed。

与宿主导主版本适配（#344）是两个独立改动，故分开提。

Summary by CodeRabbit

维护
- 将 brace-expansion 固定为 5.0.12；adm-zip 的版本设置保持不变。

osv-scanner 在 main（8519f57）上报出三条告警，全部落在 [email protected]：两个栈耗尽型 DoS（102276 的 parseCommaParts 无界递归与 push.apply 大数组、 102278 的嵌套花括号递归）与一个二次时间 CPU DoS（102277 的 {a},b} 重写循环）。三条都只影响可用性，不涉及代码执行或数据泄露。该包只经开发依赖进入：c8（覆盖率）→ test-exclude → minimatch → brace-expansion。npm ls --omit=dev 为空，package.json 的 dependencies 只有 morphicons，发布产物的 files 也不含 lockfile——安装本插件的用户拿不到这段代码。且触发这三个洞都需要把精心构造的字符串当 glob 模式喂给 expand()，在 c8 里这个输入来自项目自己的覆盖率配置，外部不可控。故真实风险≈0，但告警会一直挂在 Security 页面。按仓库既有做法（adm-zip 同样走 overrides 钉版本）加一条 overrides 到 5.0.12：三个洞分别修在 5.0.10 / 5.0.11 / 5.0.12，5.0.12 一版全清；minimatch 声明的是 ^5.0.8，其余依赖无需改动。改动只有 package.json 与 package-lock.json。测试 1437 项：1436 通过 / 0 失败 / 1 跳过。

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-09-30T11:10:26Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: slow-stack/mneme/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8218a724-7306-44cb-846c-dc85a1238258

📥 Commits

Reviewing files that changed from the base of the PR and between 9968bd0 and 9e1042f.

⛔ Files ignored due to path filters (1)

dsh-mneme/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

dsh-mneme/package.json

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

dsh-mneme 的依赖覆盖配置新增 brace-expansion，版本固定为 5.0.12。原有 adm-zip 覆盖保持不变。

Changes

依赖版本覆盖

Layer / File(s)	Summary
新增 brace-expansion 覆盖 `dsh-mneme/package.json`	`overrides` 将 `brace-expansion` 固定为 `5.0.12`。原有 `adm-zip` 覆盖未变。

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: anans-ivresse

Merge Risk: ⚪ Minimal · up to 9e104

The dependency pin addresses the reported vulnerabilities without an evident resolution or runtime compatibility mismatch. No material merge risk remains; installation and runtime execution were not independently performed.

Architecture Summary

Architecture risk: 🔵 Low · up to 9e104

The change affects 1 system.

Changed systems: dsh-mneme

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — dsh-mneme (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in dsh-mneme/package.json: overrides 新增 brace-expansion 版本 5.0.12；原有 adm-zip 覆盖未变。

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	标题准确概括了主要变更：将 brace-expansion 固定到 5.0.12，并明确说明了对应的 CVE。标题简洁、具体，与变更内容一致。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-30T11:13:50Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

… 依赖对齐 / #345 CVE 清零 / #346 测试数口径 / #348 CI 兼容腿 / #349 巩固阈值基线

* chore: v0.8.12 发布准备（版本号 + 测试徽章 + CHANGELOG/路线图占位行）请在 CHANGELOG 与两个 README 的占位行补描述后再合并。 * docs(changelog): v0.8.12 发版节承接本轮 9 个 PR——#341–#347 图谱四块 + #344 宿主 0.2 依赖对齐 / #345 CVE 清零 / #346 测试数口径 / #348 CI 兼容腿 / #349 巩固阈值基线 --------- Co-authored-by: modusensus <[email protected]>

2026-10-31 两次 push（1931508、277779f）的 Security 变红，而 CI 四条腿全绿—— 红的是 osv-scanner 那一步，不是测试。两条公告的 published 都是 2026-10-30T23:09Z，而 2139237 的 Security 跑在当天 08:36、当时还是 success：同一份 lockfile 隔了十几小时从未绿变红，所以这不是回归，是上游多了两条规则。 GHSA-3g3m-2fjr-6pw4 / CVE-2026-118773 glob 13.0.6 → 14.0.2 (Medium) GHSA-g3hv-75wg-m249 / CVE-2026-118764 minimatch 10.2.6 → 11.0.1 (Medium) 来源链只有一条，且全在 devDependency： [email protected] → [email protected] → [email protected] (+ [email protected] deduped) c8 与 test-exclude 都已是 npm 最新版、其 deps 仍写旧范围，上游没跟上，所以按 brace-expansion（PR slow-stack#345）的先例在本仓库 overrides 抬 pin： glob 14.0.3、minimatch 11.0.3，两个都写精确号而不是范围—— 范围等于把选择权交回解析器，lockfile 会在某个「只更新 lockfile」的 PR 里悄悄漂走。没有给 osv-scanner 加 ignore/allowlist：那等于把下一条真公告一起静音，而 security.yml 里 fail-on-vuln: true 正是为了不让它只当提醒。新增 test/dependency-overrides.test.js（3 条）锁住 lockfile 的解析结果、 overrides 必须是精确号、以及上游链是否还在（链没了就该来删 pin）。三条变异各自验过：删 overrides / 换成范围 / lockfile 回退，各红对应那条。验证：npm test 2572 / 2571 pass / 0 fail / 1 skipped；check-sync 81 文件一致； npm audit 0 vulnerabilities；另用 OSV querybatch 扫了 lockfile 全部 162 个包 = 0 命中；在干净目录 npm ci 复验解析结果一致。

Copilot AI lite review requested due to automatic review settings September 30, 2026 11:10

Copilot AI reviewed Sep 30, 2026

modusensus mentioned this pull request Sep 30, 2026

fix(docs): 测试数处处一致——替换规则收拢到共用模块 #346

Merged

Merge branch 'main' into fix/osv-brace-expansion

9e1042f

Copilot AI lite review requested due to automatic review settings September 30, 2026 12:21

Copilot AI reviewed Sep 30, 2026

modusensus merged commit 4c05a52 into main Sep 30, 2026
9 checks passed

modusensus deleted the fix/osv-brace-expansion branch September 30, 2026 12:28

modusensus added a commit that referenced this pull request Oct 1, 2026

docs(changelog): v0.8.12 发版节承接本轮 9 个 PR——#341–#347 图谱四块 + #344 宿主 0.2…

96ac97b

… 依赖对齐 / #345 CVE 清零 / #346 测试数口径 / #348 CI 兼容腿 / #349 巩固阈值基线

modusensus mentioned this pull request Oct 1, 2026

release: v0.8.12 发布准备 #352

Merged

modusensus mentioned this pull request Oct 31, 2026

fix(deps): glob 与 minimatch 抬到公告修复线以上，清掉 osv-scanner 的两条 Medium #538

Merged

Navigation Menu

Repository navigation

fix(deps): brace-expansion 钉到 5.0.12（CVE-2026-102276/102277/102278） - #345

fix(deps): brace-expansion 钉到 5.0.12（CVE-2026-102276/102277/102278）#345
modusensus merged 2 commits into
mainfrom
fix/osv-brace-expansion

modusensus commented Sep 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

codecov Bot commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

modusensus commented Sep 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

问题

影响面：实际打不着

改动

验证

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Architecture Summary

Uh oh!

codecov Bot commented Sep 30, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

modusensus commented Sep 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading