Visitar URL original
fix: update bundled brace expansion to a patched version by zkochan · Pull Request #295 · pnpm/action-setup · GitHub
Skip to content

fix: update bundled brace expansion to a patched version - #295

Open
zkochan wants to merge 1 commit into
masterfrom
fix/patched-brace-expansion
Open

fix: update bundled brace expansion to a patched version#295
zkochan wants to merge 1 commit into
masterfrom
fix/patched-brace-expansion

Conversation

@zkochan

@zkochan zkochan commented Nov 3, 2026

Copy link
Copy Markdown
Member

Fixes #279.

Update the transitive brace-expansion dependency from 1.1.12 to patched 1.1.21 and rebuild the distributed action. This removes the vulnerable implementation used by cache glob matching, including the exponential expansion described in GHSA-3jxr-9vmj-r5cp. No direct dependency ranges change.

Validation: the advisory's 30-group input completes in milliseconds with the patched dependency; the existing regression tests, TypeScript check, and bundle build pass locally. CI verifies bundle reproducibility and the action on Linux, macOS, and Windows.

Written by an agent (Codex, GPT-6).

@coderabbitai

coderabbitai Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 2
  • dist/index.js is excluded by !**/dist/**
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 44604591-cf00-4706-93d0-c6ca8db14fbb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@zkochan zkochan mentioned this pull request Nov 3, 2026
Open
@zkochan
zkochan marked this pull request as ready for review November 3, 2026 13:56
greptile-apps[bot]
greptile-apps Bot reviewed Nov 3, 2026
View reviewed changes

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your trial has ended. Reactivate Greptile to resume code reviews.

@qodo-code-review

qodo-code-review Bot commented Nov 3, 2026

Copy link
Copy Markdown

PR Summary by Qodo

Patch transitive brace-expansion used by cache glob matching

🐞 Bug fix 🕐 Less than 10 minutes

Grey Divider

AI Description 

• Updates the locked brace-expansion version from 1.1.12 to patched 1.1.21.
• Removes the vulnerable expansion implementation from the dependency resolved for cache glob
 matching.
Diagram 

graph TD
  L["pnpm lockfile"] -->|pins| B["Patched brace expansion"] -->|used by| M["minimatch"] -->|used by| G["Cache glob hashing"]
  D["Distributed action"] -->|runs| G
Loading
High-Level Assessment

Updating the transitive lockfile resolution is the narrowest approach: it retains direct dependency ranges and avoids replacing the glob-matching stack. Because action.yml runs dist/index.js, confirm that the committed bundle contains the patched implementation; the supplied diff shows only the lockfile change.

Files changed (1) +4 / -4

Other (1) +4 / -4
pnpm-lock.yamlResolve minimatch to patched brace-expansion 1.1.21 +4/-4

Resolve minimatch to patched brace-expansion 1.1.21

• Replaces the brace-expansion 1.1.12 package resolution and snapshot with 1.1.21, including its integrity hash. Updates minimatch's snapshot to reference the patched version without changing direct dependency ranges.

pnpm-lock.yaml

@zkochan

zkochan commented Nov 3, 2026

Copy link
Copy Markdown
Member Author

Ready to merge. The rebuilt action uses patched brace-expansion 1.1.21. All CI checks pass, including CodeQL, bundle reproducibility, and the Linux/macOS/Windows action tests. CodeRabbit approved current head 3937981, and there are no unresolved review threads. This addresses the dependency in issue #279; publishing a release remains necessary for tagged consumers.

Written by an agent (Codex, GPT-6).

This was referenced Nov 3, 2026
Open
Merged
@github-actions github-actions Bot mentioned this pull request Nov 6, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update bundled brace-expansion for GHSA-3jxr-9vmj-r5cp

1 participant

@zkochan