sscoble/pi-mono
1
0
Fork 0
mirror of https://github.com/badlogic/pi-mono.git synced 2026-11-05 23:37:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(coding-agent): pin brace-expansion 5.0.12

Browse source 
minimatch 10.2.6 (latest) still allows brace-expansion ^5.0.8, so pin the
patched version directly to keep the shrinkwrap off vulnerable releases.

closes #10288
This commit is contained in:
Armin Ronacher 2026-10-02 10:40:58 +02:00
parent 28eaccb8e8
commit 0495646a83
5 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
package-lock.json generated
View file

@ -2386,9 +2386,9 @@
"license": "MIT"
},
"node_modules/brace-expansion": {
"version": "5.0.9",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
"integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"version": "5.0.12",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
@ -5452,6 +5452,7 @@
"@earendil-works/pi-mcp": "^1.0.0",
"@earendil-works/pi-tui": "^1.0.0",
"@silvia-odwyer/photon-node": "0.3.4",
"brace-expansion": "5.0.12",
"chalk": "6.0.0",
"cross-spawn": "7.0.6",
"diff": "8.0.4",

4
packages/coding-agent/CHANGELOG.md
View file

@ -6,6 +6,10 @@
- Added a copy key (`app.message.copy`, default `ctrl+x`) to OAuth sign-in screens in `/login`, `/mcp`, and `/mcp login`, which copies the sign-in URL when the browser cannot be opened or the wrapped link cannot be selected.
### Fixed
- Fixed the shrinkwrap shipping vulnerable `brace-expansion` 5.0.9 by pinning `brace-expansion` 5.0.12 as a direct dependency (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) ([#10288](https://github.com/earendil-works/pi/issues/10288))
## [1.0.0] - 2026-10-01
### New Features

7
packages/coding-agent/install-lock/package-lock.json generated
View file

@ -514,6 +514,7 @@
"@earendil-works/pi-mcp": "^1.0.0",
"@earendil-works/pi-tui": "^1.0.0",
"@silvia-odwyer/photon-node": "0.3.4",
"brace-expansion": "5.0.12",
"chalk": "6.0.0",
"cross-spawn": "7.0.6",
"diff": "8.0.4",
@ -1221,9 +1222,9 @@
"license": "MIT"
},
"node_modules/brace-expansion": {
"version": "5.0.9",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
"integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"version": "5.0.12",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"

7
packages/coding-agent/npm-shrinkwrap.json generated
View file

@ -16,6 +16,7 @@
"@earendil-works/pi-mcp": "^1.0.0",
"@earendil-works/pi-tui": "^1.0.0",
"@silvia-odwyer/photon-node": "0.3.4",
"brace-expansion": "5.0.12",
"chalk": "6.0.0",
"cross-spawn": "7.0.6",
"diff": "8.0.4",
@ -1211,9 +1212,9 @@
"license": "MIT"
},
"node_modules/brace-expansion": {
"version": "5.0.9",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
"integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"version": "5.0.12",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"

1
packages/coding-agent/package.json
View file

@ -56,6 +56,7 @@
"@earendil-works/pi-mcp": "^1.0.0",
"@earendil-works/pi-tui": "^1.0.0",
"@silvia-odwyer/photon-node": "0.3.4",
"brace-expansion": "5.0.12",
"chalk": "6.0.0",
"cross-spawn": "7.0.6",
"diff": "8.0.4",