Skip to content

Bump brace-expansion from 5.0.4 to 5.0.7 - #1

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/brace-expansion-5.0.7
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/brace-expansion-5.0.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown

Bumps brace-expansion from 5.0.4 to 5.0.7.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.4 to 5.0.7.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.4...v5.0.7)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
@jonathanwerts

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Details – e7003b4f-a8e4-4543-b8b0-5e38c6d7f965


New Issues (6) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM CVE-2026-9679 Npm-undici-5.29.0
detailsRecommended version: 6.27.0
Description: Impact: undici's cookie parser in `parseSetCookie` percent-decodes cookie values via `qsUnescape`, turning encoded sequences like `%0D%0A`, `%00`, ...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: kHB5j6ijvLTEcZlfZaLMED6dTKMhRQUBBXXCs1%2BWUFc%3D
Vulnerable Package
2 MEDIUM CVE-2026-9679 Npm-undici-6.24.1
detailsRecommended version: 6.27.0
Description: Impact: undici's cookie parser in `parseSetCookie` percent-decodes cookie values via `qsUnescape`, turning encoded sequences like `%0D%0A`, `%00`, ...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: 3jINFTzRYc%2F6em%2FnQAFhuQMPXV47cvQ1kXqG2Ofjbg4%3D
Vulnerable Package
3 LOW CVE-2026-11525 Npm-undici-5.29.0
detailsRecommended version: 6.27.0
Description: Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather t...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: UNOVhLhfR8f8hFMYbirDwIwRJGT%2BNrRZckHeiMkXw8A%3D
Vulnerable Package
4 LOW CVE-2026-11525 Npm-undici-6.24.1
detailsRecommended version: 6.27.0
Description: Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather t...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: 8qPlZqZ1F3X6R8MEDXc%2FNC0%2FXPafmCviJsSXgicsJxM%3D
Vulnerable Package
5 LOW CVE-2026-6733 Npm-undici-6.24.1
detailsRecommended version: 6.27.0
Description: Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: H%2BNh9nr%2FC6rwdAn%2F9YaI%2BuEiTLH1v3TIHxu2pekfISo%3D
Vulnerable Package
6 LOW CVE-2026-6733 Npm-undici-5.29.0
detailsRecommended version: 6.27.0
Description: Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: D%2B%2BH3dvuGd4Rif3cPHu53eMTY4bA44M%2FG5c1DoAqiNg%3D
Vulnerable Package

Fixed Issues (2) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
HIGH CVE-2026-33750 Npm-brace-expansion-5.0.4
HIGH CVE-2026-45149 Npm-brace-expansion-5.0.4

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

@dependabot @github

dependabot Bot commented on behalf of github Oct 3, 2026

Copy link
Copy Markdown
Author

Superseded by #3.

@dependabot dependabot Bot closed this Oct 3, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/brace-expansion-5.0.7 branch October 3, 2026 07:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant