The `npm audit --audit-level=high` step in `make verify` fails on every PR since GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7, high severity, DoS via unbounded expansion) was published. All 4 open Dependabot PRs (#132–#135) are red because of it, and the next push to main would fail too.
Why it can't be fixed in the dependency tree today:
- Only patched version is 5.0.8 — no 1.x backport exists.
- eslint 9 and eslint-config-next's plugin chain (eslint-plugin-import / react / jsx-a11y, all published versions) depend on minimatch@3, which requires brace-expansion ^1.
- Forcing 5.0.8 via an npm override breaks eslint (`TypeError: expand is not a function` — 5.x changed its export shape).
Impact assessment: dev-tree only. `npm audit --omit=dev --audit-level=high` reports 0 vulnerabilities; the advisory is a lint-time DoS with no exposure in the deployed app.
Fix: scope the audit gate to production dependencies (`--omit=dev`). Revert to a full-tree gate once upstream ships releases off minimatch@3.
The `npm audit --audit-level=high` step in `make verify` fails on every PR since GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7, high severity, DoS via unbounded expansion) was published. All 4 open Dependabot PRs (#132–#135) are red because of it, and the next push to main would fail too.
Why it can't be fixed in the dependency tree today:
Impact assessment: dev-tree only. `npm audit --omit=dev --audit-level=high` reports 0 vulnerabilities; the advisory is a lint-time DoS with no exposure in the deployed app.
Fix: scope the audit gate to production dependencies (`--omit=dev`). Revert to a full-tree gate once upstream ships releases off minimatch@3.