From ef3ef46d6b5dae0c330fef8ff8664a244dfc2c89 Mon Sep 17 00:00:00 2001 From: anupamme Date: Wed, 29 Jul 2026 10:25:36 +0000 Subject: [PATCH 1/4] fix: CVE-2026-14257 security vulnerability Automated dependency upgrade by OrbisAI Security --- package.json | 5 ++++- yarn.lock | 10 ++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index f0426280..87afd650 100644 --- a/package.json +++ b/package.json @@ -29,5 +29,8 @@ "husky": "^9.1.7", "lint-staged": "^17.2.0" }, - "packageManager": "yarn@4.17.1+sha512.ccbfabf7d7b6b32075088be9386fb9a2e00bb6887ef07fa56effabc890a56d53da1ccc4128d62db245fcbd3961b236d75335bdf7d5320ed6eafb7588b7ad4697" + "packageManager": "yarn@4.17.1+sha512.ccbfabf7d7b6b32075088be9386fb9a2e00bb6887ef07fa56effabc890a56d53da1ccc4128d62db245fcbd3961b236d75335bdf7d5320ed6eafb7588b7ad4697", + "dependencies": { + "brace-expansion": "5.0.8" + } } diff --git a/yarn.lock b/yarn.lock index 12e0b938..cc554df0 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1064,6 +1064,7 @@ __metadata: resolution: "@vkontakte/icons-monorepo@workspace:." dependencies: "@biomejs/biome": "npm:^2.5.3" + brace-expansion: "npm:5.0.8" husky: "npm:^9.1.7" lint-staged: "npm:^17.2.0" languageName: unknown @@ -1582,6 +1583,15 @@ __metadata: languageName: node linkType: hard +"brace-expansion@npm:5.0.8": + version: 5.0.8 + resolution: "brace-expansion@npm:5.0.8" + dependencies: + balanced-match: "npm:^4.0.2" + checksum: 10/75d2d2ebc8f5f65156d16706216d23e48f499a1164e4b045e0ca4045d3ce6b16ced11ea2e4c76e3670b6c38454123213f43d23127df8fc6840980aea9a35e061 + languageName: node + linkType: hard + "brace-expansion@npm:^2.0.2": version: 2.1.2 resolution: "brace-expansion@npm:2.1.2" From 248100232712ac3f6c5ba30da3480c4c45de2db4 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Wed, 29 Jul 2026 16:21:53 +0530 Subject: [PATCH 2/4] fix: use resolutions to force brace-expansion to 5.0.8 across full tree Previous fix added brace-expansion as a direct dependency, which left minimatch@9's transitive brace-expansion@2.1.2 copy unaffected. Switch to a Yarn resolutions override so all consumers resolve to 5.0.8. Co-Authored-By: Claude Sonnet 4.6 --- package.json | 2 +- yarn.lock | 26 -------------------------- 2 files changed, 1 insertion(+), 27 deletions(-) diff --git a/package.json b/package.json index 87afd650..1d0ca891 100644 --- a/package.json +++ b/package.json @@ -30,7 +30,7 @@ "lint-staged": "^17.2.0" }, "packageManager": "yarn@4.17.1+sha512.ccbfabf7d7b6b32075088be9386fb9a2e00bb6887ef07fa56effabc890a56d53da1ccc4128d62db245fcbd3961b236d75335bdf7d5320ed6eafb7588b7ad4697", - "dependencies": { + "resolutions": { "brace-expansion": "5.0.8" } } diff --git a/yarn.lock b/yarn.lock index cc554df0..abc75fe3 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1064,7 +1064,6 @@ __metadata: resolution: "@vkontakte/icons-monorepo@workspace:." dependencies: "@biomejs/biome": "npm:^2.5.3" - brace-expansion: "npm:5.0.8" husky: "npm:^9.1.7" lint-staged: "npm:^17.2.0" languageName: unknown @@ -1516,13 +1515,6 @@ __metadata: languageName: node linkType: hard -"balanced-match@npm:^1.0.0": - version: 1.0.2 - resolution: "balanced-match@npm:1.0.2" - checksum: 10/9706c088a283058a8a99e0bf91b0a2f75497f185980d9ffa8b304de1d9e58ebda7c72c07ebf01dadedaac5b2907b2c6f566f660d62bd336c3468e960403b9d65 - languageName: node - linkType: hard - "balanced-match@npm:^4.0.2": version: 4.0.2 resolution: "balanced-match@npm:4.0.2" @@ -1592,24 +1584,6 @@ __metadata: languageName: node linkType: hard -"brace-expansion@npm:^2.0.2": - version: 2.1.2 - resolution: "brace-expansion@npm:2.1.2" - dependencies: - balanced-match: "npm:^1.0.0" - checksum: 10/0e0f9b0df1f0809e9c326470e022eeb24334ddb54c43b1ac39f1d38f3cbaeb940794de1db826f5491843ac00d7932c43f10350a65ccd51fe7d05da627152f204 - languageName: node - linkType: hard - -"brace-expansion@npm:^5.0.2": - version: 5.0.6 - resolution: "brace-expansion@npm:5.0.6" - dependencies: - balanced-match: "npm:^4.0.2" - checksum: 10/a7acf120fefa79e9d7c9c92898114f57c07596a3920197f3c5917e6a628b04220a5f7f9618c30bdd973a6576a32113b99f9c3f1c8245ccc399dd2a9a718d81d8 - languageName: node - linkType: hard - "browserslist@npm:^4.28.1": version: 4.28.1 resolution: "browserslist@npm:4.28.1" From 4ff812e853b8b93fa03bd86a4c0dce202aae3617 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Wed, 29 Jul 2026 17:38:45 +0530 Subject: [PATCH 3/4] fix: move @swc/cli to devDependencies in icons-scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @swc/cli is a build-time tool invoked via exec() — it should not be a published runtime dependency. Having it in dependencies causes downstream consumers to transitively pull in the vulnerable brace-expansion@2.x via minimatch@^9. Moving it to devDependencies removes that chain from the published package entirely. Co-Authored-By: Claude Opus 4.6 --- packages/icons-scripts/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/icons-scripts/package.json b/packages/icons-scripts/package.json index 6e7b2c89..835fc697 100644 --- a/packages/icons-scripts/package.json +++ b/packages/icons-scripts/package.json @@ -14,7 +14,6 @@ "email": "ig.fedorov@corp.vk.com" }, "dependencies": { - "@swc/cli": "^0.8.1", "@swc/core": "^1.15.43", "glob": "^13.0.6", "hast-util-from-html": "^2.0.3", @@ -29,6 +28,7 @@ "svgo": "^4.0.2" }, "devDependencies": { + "@swc/cli": "^0.8.1", "typescript": "^7.0.2" }, "engines": { From 8718648e1140264f335df5d2cb1a4902f57b0e5a Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Wed, 29 Jul 2026 18:15:27 +0530 Subject: [PATCH 4/4] fix: use resolutions to force brace-expansion to 5.0.8 across full tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove the resolutions override — brace-expansion@2.1.3 contains the CVE-2026-14257 fix natively, so the ^2.0.2 range now resolves to a patched version without forcing a cross-major override. The lockfile now carries 2.1.3 (for minimatch@9) and 5.0.8 (for minimatch@10), both containing the fix. Co-Authored-By: Claude Opus 4.6 --- package.json | 5 +---- yarn.lock | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 1d0ca891..f0426280 100644 --- a/package.json +++ b/package.json @@ -29,8 +29,5 @@ "husky": "^9.1.7", "lint-staged": "^17.2.0" }, - "packageManager": "yarn@4.17.1+sha512.ccbfabf7d7b6b32075088be9386fb9a2e00bb6887ef07fa56effabc890a56d53da1ccc4128d62db245fcbd3961b236d75335bdf7d5320ed6eafb7588b7ad4697", - "resolutions": { - "brace-expansion": "5.0.8" - } + "packageManager": "yarn@4.17.1+sha512.ccbfabf7d7b6b32075088be9386fb9a2e00bb6887ef07fa56effabc890a56d53da1ccc4128d62db245fcbd3961b236d75335bdf7d5320ed6eafb7588b7ad4697" } diff --git a/yarn.lock b/yarn.lock index abc75fe3..062cb151 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1515,6 +1515,13 @@ __metadata: languageName: node linkType: hard +"balanced-match@npm:^1.0.0": + version: 1.0.2 + resolution: "balanced-match@npm:1.0.2" + checksum: 10/9706c088a283058a8a99e0bf91b0a2f75497f185980d9ffa8b304de1d9e58ebda7c72c07ebf01dadedaac5b2907b2c6f566f660d62bd336c3468e960403b9d65 + languageName: node + linkType: hard + "balanced-match@npm:^4.0.2": version: 4.0.2 resolution: "balanced-match@npm:4.0.2" @@ -1575,7 +1582,16 @@ __metadata: languageName: node linkType: hard -"brace-expansion@npm:5.0.8": +"brace-expansion@npm:^2.0.2": + version: 2.1.3 + resolution: "brace-expansion@npm:2.1.3" + dependencies: + balanced-match: "npm:^1.0.0" + checksum: 10/72a6d8c6be638a883dc3adfb88a41f2c34130512e0255bb845f6804f0f577b83d2f84247eec33c32b3adedd4849ccc53b84c54a8267594fabc1f8293ebc7ae02 + languageName: node + linkType: hard + +"brace-expansion@npm:^5.0.2": version: 5.0.8 resolution: "brace-expansion@npm:5.0.8" dependencies: