From dc755ac3bf86bf8fba9ff5849dc91f6f7d0a5a40 Mon Sep 17 00:00:00 2001 From: enyineer <27201677+enyineer@users.noreply.github.com> Date: Thu, 30 Jul 2026 07:06:53 +0000 Subject: [PATCH] fix(security): auto-remediate fixable vulnerabilities --- .changeset/auto-security-remediation.md | 9 +++++++++ bun.lock | 9 +++++---- core/backend/package.json | 2 +- core/scripts/package.json | 2 +- package.json | 6 ++++-- security/managed-overrides.json | 8 ++++++++ 6 files changed, 28 insertions(+), 8 deletions(-) create mode 100644 .changeset/auto-security-remediation.md diff --git a/.changeset/auto-security-remediation.md b/.changeset/auto-security-remediation.md new file mode 100644 index 000000000..fa5456dae --- /dev/null +++ b/.changeset/auto-security-remediation.md @@ -0,0 +1,9 @@ +--- +"@checkstack/backend": patch +"@checkstack/scripts": patch +--- + +Security: auto-remediated fixable vulnerabilities flagged by the daily scan. + +- `tar` 7.5.20 → 7.5.21 (GHSA-r292-9mhp-454m) +- `brace-expansion` 5.0.7 → 5.0.8 (CVE-2026-14257) diff --git a/bun.lock b/bun.lock index d05f8a95c..dca131d4f 100644 --- a/bun.lock +++ b/bun.lock @@ -500,7 +500,7 @@ "jose": "^6.2.3", "pg": "^8.11.0", "semver": "^7.8.1", - "tar": "^7.5.16", + "tar": "^7.5.21", "winston": "^3.19.0", "zod": "^4.2.1", }, @@ -2080,7 +2080,7 @@ "handlebars": "^4.7.8", "inquirer": "^13.4.1", "react": "^19.0.0", - "tar": "^7.5.16", + "tar": "^7.5.21", "zod": "^4.4.3", }, "devDependencies": { @@ -3591,6 +3591,7 @@ "overrides": { "@astrojs/markdown-remark": "^7.2.0", "adm-zip": "^0.6.0", + "brace-expansion": "^5.0.8", "dompurify": "^3.4.11", "drizzle-kit": ">=0.31.0 <1.0.0", "drizzle-orm": "^0.45.0", @@ -5285,7 +5286,7 @@ "boolbase": ["boolbase@1.0.0", "", {}, "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="], - "brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="], + "brace-expansion": ["brace-expansion@5.0.8", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg=="], "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="], @@ -6695,7 +6696,7 @@ "tailwindcss-animate": ["tailwindcss-animate@1.0.7", "", { "peerDependencies": { "tailwindcss": ">=3.0.0 || insiders" } }, "sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA=="], - "tar": ["tar@7.5.20", "", { "dependencies": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", "minipass": "^7.1.2", "minizlib": "^3.1.0", "yallist": "^5.0.0" } }, "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ=="], + "tar": ["tar@7.5.22", "", { "dependencies": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", "minipass": "^7.1.2", "minizlib": "^3.1.0", "yallist": "^5.0.0" } }, "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA=="], "tar-fs": ["tar-fs@3.1.3", "", { "dependencies": { "pump": "^3.0.0", "tar-stream": "^3.1.5" }, "optionalDependencies": { "bare-fs": "^4.0.1", "bare-path": "^3.0.0" } }, "sha512-/hU4AXnIdZu+Gvl1pk0oI5f5HxWsCJRtY2aFaJdk9VvyL48DWU6iU5WAIPG+wIi1YvWA6eTJvIviP/tMAZZNwQ=="], diff --git a/core/backend/package.json b/core/backend/package.json index 7b2f66646..061a8d0b8 100644 --- a/core/backend/package.json +++ b/core/backend/package.json @@ -43,7 +43,7 @@ "jose": "^6.2.3", "pg": "^8.11.0", "semver": "^7.8.1", - "tar": "^7.5.16", + "tar": "^7.5.21", "winston": "^3.19.0", "zod": "^4.2.1" }, diff --git a/core/scripts/package.json b/core/scripts/package.json index 37c62ca19..908d203bb 100644 --- a/core/scripts/package.json +++ b/core/scripts/package.json @@ -34,7 +34,7 @@ "handlebars": "^4.7.8", "inquirer": "^13.4.1", "react": "^19.0.0", - "tar": "^7.5.16", + "tar": "^7.5.21", "zod": "^4.4.3" }, "devDependencies": { diff --git a/package.json b/package.json index 4f034f9b7..101505373 100644 --- a/package.json +++ b/package.json @@ -82,7 +82,8 @@ "@astrojs/markdown-remark": "^7.2.0", "adm-zip": "^0.6.0", "fast-uri": "^3.1.4", - "sharp": "^0.35.0" + "sharp": "^0.35.0", + "brace-expansion": "^5.0.8" }, "resolutions": { "drizzle-orm": "^0.45.0", @@ -98,6 +99,7 @@ "@astrojs/markdown-remark": "^7.2.0", "adm-zip": "^0.6.0", "fast-uri": "^3.1.4", - "sharp": "^0.35.0" + "sharp": "^0.35.0", + "brace-expansion": "^5.0.8" } } diff --git a/security/managed-overrides.json b/security/managed-overrides.json index bacf4c756..f676bce18 100644 --- a/security/managed-overrides.json +++ b/security/managed-overrides.json @@ -72,6 +72,14 @@ "reason": "Auto-remediated by Security Maintenance: sharp 0.34.5 had fixable advisories; pinned to the fixed 0.x line.", "addedAt": "2026-07-23", "removeWhen": "No dependency resolves below 0.35.0 without this override." + }, + "brace-expansion": { + "safeFloor": "5.0.8", + "severity": "HIGH", + "advisory": "CVE-2026-14257", + "reason": "Auto-remediated by Security Maintenance: brace-expansion 5.0.7 had fixable advisories; pinned to the fixed 5.x line.", + "addedAt": "2026-07-30", + "removeWhen": "No dependency resolves below 5.0.8 without this override." } }, "intentional": {