[dependabot]

Bumps and brace-expansion. These dependencies needed to be updated together.
Updates brace-expansion from 2.1.4 to 2.1.7

Commits

• 714b622 2.1.7
• bdff773 Merge commit from fork
• 5a5c07b 2.1.6
• 6463f2f update lockfile
• 1ba3c71 Merge commit from fork
• aae3387 2.1.5
• 5171e68 Merge commit from fork
• See full diff in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

• 714b622 2.1.7
• bdff773 Merge commit from fork
• 5a5c07b 2.1.6
• 6463f2f update lockfile
• 1ba3c71 Merge commit from fork
• aae3387 2.1.5
• 5171e68 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[psiinon]

Checkmarx One – Scan Summary & Details – 8be4c35e-6f64-4493-b6c0-fdbc25101631

---

New Issues (10 out of 10)

Checkmarx found the following issues in this Pull Request

Severity: 8 High · 2 Medium

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-102282	Npm-adm-zip-0.5.16	details Recommended version: 0.6.1 Description: adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=tru... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
2		CVE-2026-109383	Npm-undici-5.29.0	details Recommended version: 6.29.1 Description: undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatche... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
3		CVE-2026-19481	Npm-@fastify/busboy-2.1.1	details Recommended version: 3.2.1 Description: @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the pars... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
4		CVE-2026-77301	Npm-adm-zip-0.5.16	details Recommended version: 0.6.1 Description: adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's cen... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5		CVE-2026-87018	Npm-undici-5.29.0	details Recommended version: 6.29.1 Description: undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6		CVE-2026-92000	Npm-adm-zip-0.5.16	details Recommended version: 0.6.1 Description: adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
7		CVE-2026-93687	Npm-braces-3.0.3	details Description: Braces contain a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace pattern... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8		Cx4315d5bf-c114	Npm-adm-zip-0.5.16	details Recommended version: 0.6.1 Description: Denial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9		CVE-2026-109932	Npm-undici-5.29.0	details Recommended version: 6.29.1 Description: undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket clie... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
10		CVE-2026-74866	Npm-@fastify/busboy-2.1.1	details Recommended version: 3.2.2 Description: @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-ret... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

---

Use @Checkmarx to take action directly from this PR:

• Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR