From 8edf131301cf42e6c7ce7e338da13abc032382c1 Mon Sep 17 00:00:00 2001 From: Aaron Silverman Date: Tue, 21 Jul 2026 11:14:47 -0400 Subject: [PATCH] fix(FFESUPPORT-891): re-resolve axios + brace-expansion to patched versions Vanta/Dependabot supplement (2026-07). Re-resolve two transitive dev-tooling deps in the root package-lock.json to versions outside their vulnerable ranges: axios 1.16.1 -> 1.18.1 (GHSA-gcfj-64vw-6mp9 + 9 others, < 1.18.0) and brace-expansion 1.1.14 -> 1.1.16 (GHSA-3jxr-9vmj-r5cp, < 1.1.16). axios is pulled transitively by wait-on (via start-server-and-test), within its declared ^1.6.1 range; brace-expansion is a deep transitive. Lockfile-only; no package.json, no shipped SDK crate/package, no changeset needed. Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4b6b917c..5559fc6f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -641,9 +641,9 @@ } }, "node_modules/axios": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.1.tgz", - "integrity": "sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==", + "version": "1.18.1", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", + "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", @@ -686,9 +686,9 @@ "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==" }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0",