Repository navigation
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory #1838
Description
Deferred from the pre-2.0.0 dependency sweep (#1837). Dev-scope only — does not ship.
The alert
A brace-expansion DoS (unbounded expansion length) reachable via minimatch, inside eslint's own dependency tree. It appears 5 times in each of the 5 lockfiles (root + four clients) as:
@eslint/config-array@eslint/eslintrcbrace-expansioneslintminimatch
npm audit reports a single fix for all of them: eslint@10.8.0.
Why it was deferred rather than fixed
- It does not ship. eslint is a dev dependency; the published
filesallowlist isclients/*/build,clients/web/dist, andscripts/install-clients.mjs. - The vulnerable path is not attacker-controlled. The glob patterns fed to
minimatchcome from this repo's own eslint config. Worst case is a slow lint run on a machine that already has the source. - The fix is a major bump across five packages, likely requiring flat-config and rule migrations — not work to attempt immediately before an irreversible npm publish.
The alerts were dismissed as tolerable_risk with that reasoning recorded. This issue exists so the dismissal is not the only record that real work remains — a dismissed alert reads too easily as a solved problem.
Scope
- Bump eslint to 10.x in the root and all four clients (each has its own
package.json/ lockfile — v2 is not an npm workspace). - Migrate config as required; the root
eslint.config.jsalso gatescore/and the shared surface (lint:core,lint:shared). - Verify
npm run cipasses — lint runs invalidatefor every client. - Confirm the 25 alerts clear, and un-dismiss rather than leave them dismissed-but-fixed.
Related
- chore: clear all runtime dependency vulnerabilities; 2.0.0-rc.2 #1837 — the sweep that cleared all prod-scope alerts and deferred this
- The vitest/Storybook pin knot, tracked separately
Activity
cliffhall commentedon Jul 28, 2026
Confirmed by Dependabot: the automated bump cannot work unassisted.
Dependabot opened #1840 attempting exactly this upgrade, and its build failed:
Failed run
So this is not a version-bump task.
eslint-plugin-react-hooks@7.0.1does not accept eslint 10, and the@typescript-eslint/typescript-eslint@8.57.0stack sits in the same peer graph. The migration has to move the plugin set in lockstep with eslint itself.Adds a concrete first step to the scope above: audit every eslint plugin for eslint-10 support before touching eslint, and expect at least
eslint-plugin-react-hooksand thetypescript-eslintfamily to need coordinated major bumps.Also means #1840 should be closed rather than fixed — Dependabot will keep reopening it, and the work belongs here.
cliffhall commentedon Jul 28, 2026
Correction — the sweep in #1837 fixed most of this, and what remains is narrower and subtler than the issue body describes.
There are four separate
brace-expansionadvisories, not one. The sweep (bumping the 1.x copy to 1.1.16) resolved three:< 1.1.16< 1.1.13>= 5.0.0, < 5.0.6<= 5.0.7Only GHSA-mh99-v99m-4gvg remains, and it is the awkward one: its vulnerable range
<= 5.0.7carries no lower bound, sobrace-expansion@1.1.16is still inside it. The only patched version is5.0.8, which the 1.x line will never reach — so no amount of updating within eslint's existing tree fixes it. Only moving eslint to a version whose dependency graph pullsbrace-expansion5.x does.This also explains an apparent tool disagreement worth recording, since it will confuse the next person:
2026-07-28T03:25:29Zunder its low-impact dev-dependency rule, so they no longer appear in the open list.npm audithas no such rule and still reportseslint,@eslint/config-array,minimatch,brace-expansionas high, namingeslint@10.8.0as the fix.Neither is wrong. They are measuring different things: Dependabot filtered by impact, npm audit did not.
Net effect on this issue: still valid, but the driver is now "
npm auditis not clean" rather than "there are open Dependabot alerts" — GitHub has already dismissed those itself. That lowers the urgency further, and means no manual dismissal is needed for the eslint cluster; it is already handled.The blocker remains as recorded in the previous comment:
eslint-plugin-react-hooks@7.0.1does not accept eslint 10 (proven by Dependabot's own failed attempt in #1840), so the plugin set has to move in lockstep.cliffhall commentedon Aug 1, 2026
Triage: Priority = Medium
Scored 7/16 with the priority rubric added to
AGENTS.mdin #1891. This card is already approved and sitting in Todo — only Priority was set here, its Status is unchanged.brace-expansionDoS reachable through eslint's own dependency tree. Dev-scope only, does not ship, and the practical impact isnpm auditnoise across five lockfiles rather than a reachable attack on anyone.Related issues. One connected issue:
Scores are a starting point, not a verdict — the rubric is meant to be overruled when it's plainly wrong, provided the reason is written down.
docs: state useValueChange's referential-stability requirement (#1838)
fix(cli): stop asserting the --tool-args-json catch binding is an Err…
docs: require useValueChange's onChange to be render-pure (#1838)
Merge origin/v2/main into the eslint 10 migration (#1838)
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS ad…
cliffhall commentedon Aug 2, 2026
Closed by #1900, squash-merged into
v2/mainas834fd2d7. (Auto-close doesn't fire here —Closes #Nonly closes on PRs targeting the default branch, and v2 PRs targetv2/main.)