Repository navigation
[SCF-2415] [Part 6] Force patched tmp, brace-expansion, minimatch, picomatch and braces - #11
Merged
Conversation
This was referenced Oct 28, 2026
Merged
Merged
Merges the 0.0.28, 0.0.33, 0.1.0 and 0.2.3 copies into 0.2.7, which fixes CVE-2025-54798, CVE-2026-44705 and CVE-2026-49982. All dependents are dev/build tooling and only use APIs still present in 0.2.x. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The tmp resolution is "^0.2.7", but the lockfile recorded it as "tmp@0.2.7". Running yarn install rewrites the key; no resolved version changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brace-expansion 1.1.12 -> 1.1.21 (forced via resolutions). Pulled in through minimatch 3.x. Fixes CVE-2026-13149, CVE-2026-14257, CVE-2026-33750 and CVE-2026-69152 (COMP-10025..10028), plus CVE-2026-102276, CVE-2026-102277 and CVE-2026-102278. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
minimatch 3.1.2 -> 3.1.5 and mocha's exact 3.0.4 pin -> 3.1.5 (forced via resolutions). Fixes CVE-2026-26996, CVE-2026-27903 and CVE-2026-27904 (COMP-10014..10016), plus CVE-2022-3517 on 3.0.4. The floor stays on 3.x: the lockfile also resolves "minimatch@*", which would otherwise jump to a major that needs Node >= 20. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
picomatch 2.3.1 -> 2.3.2 (forced via resolutions). Pulled in through micromatch, anymatch and readdirp. Fixes CVE-2026-33671 and CVE-2026-33672 (COMP-10009, COMP-10010). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The last braces 2.3.2 copies (high) came from micromatch 3 under
ember-cli's sane watcher and its anymatch. micromatch 3 only calls
braces(pattern, options) and uses the returned array, which braces 3
still provides.
Comparing micromatch 3 before and after over brace-heavy globs: every
positive pattern (lists, ranges, nested, extensions) matches the same
files. Negated brace globs such as `!{a,b}/**` now compile to an extglob
and match differently, but sane only ever receives brace-free patterns
here (its default `**/*` and broccoli's `<outputPath>/**` ignore), and
micromatch skips braces entirely for those. `ember serve` still detects
a touched component and rebuilds.
Audit: high 56 -> 52.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fast-uri 3.0.6 -> 3.1.9 (forced via resolutions). Pulled in through ajv 8 (schema-utils, eslint's table). Fixes CVE-2026-6321, CVE-2026-6322, CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75975 and CVE-2026-76172 (COMP-10038..10042, COMP-10047, COMP-10051), plus CVE-2026-84292, CVE-2026-86472, CVE-2026-110095, CVE-2026-110306 and CVE-2026-110725. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mocha 8 pins nanoid 3.1.20 exactly; forcing it via resolutions merges it with postcss's 3.3.20. Fixes CVE-2026-67213, CVE-2026-67214 and CVE-2026-73086 (COMP-10021, COMP-10022, COMP-10046), plus CVE-2021-23566 and CVE-2024-55565 on 3.1.20. Dev-only: postcss's copy, the one that ships through runtime dependencies, was already patched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-cli 3.28 (12.3.2) and its markdown-it-terminal (8.4.2) pulled two old markdown-it copies, each with high advisories, plus linkify-it 2 and 3. markdown-it 14 still ships a CommonJS build and keeps the md().use(plugin).render() API that ember-cli's MarkdownColor relies on; linkify-it 5 comes with it. `ember help generate` and a MarkdownColor render of headings, emphasis, code, links, lists, fences and ember-cli's color tokens produce byte-identical output before and after. Audit: high 62 -> 56. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-cli 3.28 depends on lodash.template ^4.5.0 for blueprint rendering and its initial-commit message; 4.5.0 has high advisories. 4.18.1 is in the same major and clears all of them. All 49 files of ember-cli's app and addon blueprints render identically through ember-cli's processTemplate before and after. Audit: high 52 -> 50. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ansi-html 0.0.7 (high) is pinned by broccoli's ^0.0.7 range, which on a 0.0.x version allows no other release, so it needs a resolution. 0.0.9 renders broccoli's ANSI-colored build-error page identically. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
express 4.21.2 pinned body-parser 1.20.3 and path-to-regexp 0.1.12 exactly (both high). express 4.22.3, within ember-cli's and testem's ^4 ranges, takes body-parser ~1.20.5 and path-to-regexp ~0.1.13; the caret body-parser ranges from ember-a11y-testing and @scalvert/ember-setup-middleware-reporter are refreshed onto the same 1.20.9. Lockfile refresh only. testem serves the test run through express. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
compression 1.8.0 (high) -> 1.8.2, within ember-cli's and testem's ^1.7.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
engine.io 6.6.4 (high) -> 6.6.11, within socket.io's ~6.6.0 range. It brings its own ws ~8.21.0 (8.21.3). testem talks to the browser over socket.io. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
socket.io-parser 4.2.4 (high) -> 4.2.7, within socket.io's ~4.2.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ws 8.17.1 and 8.18.2 (both high) remained after the engine.io refresh: - jsdom's ^8.2.3 range refreshes to 8.22.0. - socket.io-adapter 2.5.5 pinned ws ~8.17.1; socket.io-adapter 2.5.8, within socket.io's ~2.5.2 range, takes ~8.21.0 (8.21.3), the same copy engine.io already uses. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
websocket-driver 0.7.4 (critical) -> 0.7.5, within faye-websocket's >=0.5.1 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
proxy-addr 2.0.7 (critical) -> 2.0.8, within express's ~2.0.7 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
webpack 5's terser-webpack-plugin 5.3.14 depended on serialize-javascript 6.0.2 (high; the fix, 7.x, needs Node >= 20). 5.6.1, still inside webpack's ^5.3.11 range, no longer depends on serialize-javascript at all. Lockfile refresh only. The production build bundles the same modules and identifiers; only webpack's numeric module ids in the two ember-auto-import chunks (and so their content hashes and the references in index.html) change. Audit: high 50 -> 49. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shell-quote 1.8.3 (critical, high) -> 1.12.0, within npm-run-all's ^1.6.1 range. npm-run-all drives `yarn lint`, which still runs all its tasks. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
form-data 4.0.3 (critical, high) -> 4.0.6, within jsdom's ^4.0.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@xmldom/xmldom 0.8.10 (13 high findings) -> 0.8.15, within testem's ^0.8.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
flatted 3.3.3 (high) -> 3.4.4, within flat-cache's ^3.2.9 range (eslint's cache, exercised by `yarn lint`). Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
js-yaml 3.14.1 (ember-cli, testem, tap-parser) and 4.0.0 (mocha) both have high advisories. - The ^3 ranges refresh to 3.15.2 (lockfile only). - mocha 8 pins js-yaml 4.0.0 exactly, so a resolution scoped to mocha moves it to 4.3.2 (same major). mocha uses it to read YAML config; loading a .mocharc.yml through it still runs all node tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
source-map-js 1.2.1 (high) -> 1.2.2, within css-tree's ^1.0.1 range (eslint-plugin-ember). It merges with the 1.2.2 copy already in the tree. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
underscore 1.13.7 (high) -> 1.13.8, within backbone's >=1.8.3 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gaurav0
force-pushed
the
gaurav/chore/SCF-2415-part-5-upgrade-babel
branch
from
October 28, 2026 23:56
19a9aa9 to
fb177fc
Compare
Gaurav0
force-pushed
the
gaurav/chore/SCF-2415-part-6-force-file-matching-deps
branch
from
October 28, 2026 23:57
31cd6aa to
47be990
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With push on every branch and pull_request on every base branch, each push to a branch with an open PR ran the full matrix twice. PRs are still covered by the pull_request trigger, which uses '**' so stacked PRs on gaurav/chore/... bases run (b057803). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…he type attribute Since f005cd0 the default submit button set its type with @buttonType="submit", which only BsButton understands. A custom @buttonComponent that renders <button type="button" ...attributes> ignored it, so its clicks never submitted the footer form and @onsubmit never ran. Before f005cd0, onClick={{@onsubmit}} reached any button component through ...attributes. Pass type="submit" as an HTML attribute instead. BsButton applies ...attributes after its own type, so it still renders a submit button, and @buttonType is deprecated anyway. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…andles it 6c23b4c made the footer <form> always call preventDefault() on submit, to stop the page reload when its submit button calls @onsubmit. That also blocked native submission where it used to happen: a standalone footer without @onsubmit, and a footer given an action attribute (e.g. <modal.footer action="/export" method="post">). Only prevent the default when @onsubmit is given and the form has no action attribute. That still covers the reload in BsModal, where the footer always gets onSubmit and no action. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8945d07 (upstream ember-bootstrap#2027) replaced `@arg visible = true` with `this._visible ?? true`, so @visible={{null}} (e.g. an unset model attribute) now shows the alert. @arg only falls back to its default for undefined, so null used to hide it. Fall back for undefined only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8945d07 copied @visible into the tracked _visible from a {{did-update this.updateVisibility @visible}} modifier. Writing it during modifier commit schedules a second render, and only that render runs {{did-update this.showOrHide this._visible}}, so each @visible change took an extra render pass before the fade started. Resolve visibility in the visible getter instead. A dismissal records how often @visible had changed at the time (_dismissedAt), and holds until @visible changes again, which the getter counts in untracked fields. That keeps ember-bootstrap#2027's behavior (dismiss doesn't touch @visible, and setting @visible to false and back to true shows the alert again) without writing tracked state while rendering, which is what broke @localcopy on Ember canary. showOrHide's did-update now reads @visible itself, so without a fade onDismissed is called from the afterRender queue instead of from the modifier: a handler that sets @visible (as in ember-bootstrap#2027's test) would otherwise update a value that render has already used. With a fade it was already called later, from a timer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ly under Embroider 7b53aa7 skipped it everywhere for an Embroider-only failure (ember-bootstrap#1682), so classic builds stopped checking that BsForm doesn't swallow errors thrown by @onsubmit. Skip it only when @embroider/core is installed, the check @embroider/test-setup's maybeEmbroider uses to build with Embroider. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Joeu
approved these changes
Nov 4, 2026
Gaurav0
merged commit Nov 5, 2026
ee88a0f
into
gaurav/chore/SCF-2415-part-5-upgrade-babel
152 of 157 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
resolutionsfor the file-matching and temp-file packages with known advisories. All five are transitive; none is a direct dependency.tmp^0.2.7; locked 0.2.7 only (0.0.28, 0.0.33, 0.1.0 and 0.2.3 gone)brace-expansion^1.1.21; locked 1.1.21 (was 1.1.12)minimatch^3.1.5; locked 3.1.5 (3.0.4 and 3.1.2 gone)picomatch^2.3.2; locked 2.3.2 (was 2.3.1)braces^3.0.3; locked 3.0.3 (2.3.2 gone)Each commit is one
package.jsonresolution plus the matchingyarn.lockentry, so the commits can be reviewed one at a time.Stack
Part of the SCF-2415 audit work, split from
gaurav/chore/SCF-2415-audit-critical-highfor easier review. This is part 6 of 10. Stacked on Part 5: its base isgaurav/chore/SCF-2415-part-5-upgrade-babel, so the diff only shows this part. Merge in order.@visibleregressionsReview notes
One resolution per commit. Check that each locked version is the patched one.
Testing
yarn install --frozen-lockfilepasses on this branch. The full suite (yarn lint,ember test) was run on Part 9 (0 lint errors, 526 passed, 10 skipped, 0 failed) and again on Part 10 (0 lint errors, 532 passed, 9 skipped, 0 failed). Part 10 adds 5 tests and un-skips 1.🤖 Generated with Claude Code