From b8f922bd438f5565aff9d2013af3b87dadba472e Mon Sep 17 00:00:00 2001 From: sanex3339 Date: Fri, 10 Jul 2026 20:06:55 +0400 Subject: [PATCH] Bumped the production `brace-expansion` transitive dependency to a patched version, resolving `CVE-2026-25547` --- CHANGELOG.md | 1 + package.json | 3 +++ yarn.lock | 9 +++++---- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e323b3353..4a42eacea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ Change Log v5.4.7 --- +* Bumped the production `brace-expansion` transitive dependency to a patched version, resolving `CVE-2026-25547`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1405 * Fixed `URIError: URI malformed` crash when `stringArray` with `base64`/`rc4` encoding processed a string literal containing lone surrogate code units (e.g. `"[^\uD800-\uDFFF]"`). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1431 v5.4.6 diff --git a/package.json b/package.json index 9ccf2b7d8..fcd4b84fc 100644 --- a/package.json +++ b/package.json @@ -100,6 +100,9 @@ "webpack-cli": "6.0.1", "webpack-node-externals": "3.0.0" }, + "resolutions": { + "multimatch/minimatch/brace-expansion": "^1.1.12" + }, "repository": { "type": "git", "url": "git+https://github.com/javascript-obfuscator/javascript-obfuscator.git" diff --git a/yarn.lock b/yarn.lock index 0ba02834c..123dfed6f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1336,10 +1336,10 @@ baseline-browser-mapping@^2.8.19: resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.8.21.tgz#2f9cccde871bfa4aec9dbf92d0ee746e4f1892e4" integrity sha512-JU0h5APyQNsHOlAM7HnQnPToSDQoEBZqzu/YBlqDnEeymPnZDREeXJA3KBMQee+dKteAxZ2AtvQEvVYdZf241Q== -brace-expansion@^1.1.7: - version "1.1.11" - resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz" - integrity sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA== +brace-expansion@^1.1.12, brace-expansion@^1.1.7: + version "1.1.16" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.16.tgz#723d3a30c0558c225abc9fc479a73e14e26c3c2f" + integrity sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw== dependencies: balanced-match "^1.0.0" concat-map "0.0.1" @@ -4946,6 +4946,7 @@ string-template@1.0.0: integrity sha1-np8iM9wA8hhxjsN5oopWc+zKi5Y= "string-width-cjs@npm:string-width@^4.2.0", string-width@^4.2.3: + name string-width-cjs version "4.2.3" resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010" integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==