Repository navigation
build(deps-dev): bump brace-expansion from 1.1.12 to 1.1.16 in /ui in the npm_and_yarn group across 1 directory - #1016
Merged
intel352 merged 3 commits intoOct 2, 2026
Conversation
Bumps the npm_and_yarn group with 1 update in the /ui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.12 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.16) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
intel352
previously approved these changes
Oct 2, 2026
intel352
left a comment
intel352
left a comment
Contributor
There was a problem hiding this comment.
Reviewed exact commit 623b41e. Reviewed the dependency-only update, official dependency/action provenance, manifest/lock consistency and runtime/toolchain compatibility against the current base; no blocking source findings. All reported exact-head checks passed, but the separately required Code Quality results are absent and must be provided before normal merge. Approved source changes after independent review. Existing review requirements, including an eligible approval from someone other than the latest pusher where required, remain enforced. No bypass or auto-merge is requested.
intel352
approved these changes
Oct 2, 2026
intel352
left a comment
intel352
left a comment
Contributor
There was a problem hiding this comment.
Security and quality review approved for exact head e8cca30. Independent full-source review across all15 adversarial classes found no introduced defect: only the two existing brace-expansion lock entries advance to1.1.21/5.0.12, retaining their parent semver ranges and authentic registry integrity/dependencies. The published5.x engine change remains compatible with CI Node24 and the existing modern Vite graph. I independently rechecked official registry metadata and current OSV exact-version queries; both patched targets have no advisory matches. Other lock objects, manifests, source, tests, workflows, permissions and security gates are unchanged. Genuine local131 UI tests, lint and production build passed; all21 exact-head remote checks pass, including native CI, active CodeQL Security/Quality and the real differential OSV workflow. The neutral OSV metadata summary and main/scheduled-only skip are expected. Current-main integration preserves the merged BubbleTea update. Whole-repo baseline OSV findings and the separate scanner-loader/trust-policy issue remain explicitly separate; no scanner or policy weakening is included.
intel352
deleted the
dependabot/npm_and_yarn/ui/npm_and_yarn-14b05f5ef5
branch
October 2, 2026 23:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /ui directory: brace-expansion.
Updates
brace-expansionfrom 1.1.12 to 1.1.16Release notes
Sourced from brace-expansion's releases.
Commits
447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)10c05fc1.1.141afa1b2Add opt-in { max } mitigation to v1 legacy line (#103)2fbb6a2Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)0d7652eBackport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)6c353ca1.1.137fd684fBackport fix for GHSA-f886-m6hf-6m8v (#95)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.