From 0aed1dbe81d7608c647d80bb064bde0fcc2ce5ee Mon Sep 17 00:00:00 2001
From: Antonis Lilis <antonis.lilis@sentry.io>
Date: Tue, 28 Jul 2026 13:58:40 +0200
Subject: [PATCH] chore(deps): force brace-expansion to ^5.0.8 to fully resolve
 OOM DoS advisory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Consolidates the scattered brace-expansion resolutions into a single
global "brace-expansion": "^5.0.8", forcing every copy — including the
1.x/2.x carriers pulled via older minimatch (3.x/9.x) — up to 5.0.8.

Fully resolves GHSA-mh99-v99m-4gvg (brace-expansion OOM DoS, affects
<=5.0.7; only fix is 5.0.8, no 1.x/2.x backport). Completes the partial
fix in #6521, which only covered the 5.x copy.

Dev/build-tooling only (brace-expansion is pulled via minimatch under
@expo/*, @microsoft/api-extractor, @npmcli/*, @nx/devkit, lerna); the
shipped @sentry/react-native production tree is unaffected.

Verified: yarn npm audit --recursive reports 0 advisories; yarn install
--immutable passes; yarn build and yarn test (2071 tests) pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 package.json |  8 +-------
 yarn.lock    | 33 ---------------------------------
 2 files changed, 1 insertion(+), 40 deletions(-)

diff --git a/package.json b/package.json
index c5def530c7..b39afb8282 100644
--- a/package.json
+++ b/package.json
@@ -113,17 +113,11 @@
     "@expo/metro-config@npm:55.0.9/picomatch": "^4.0.4",
     "npm-run-all2@npm:8.0.4/picomatch": "^4.0.4",
     "tinyglobby@npm:0.2.15/picomatch": "^4.0.4",
-    "minimatch@npm:10.2.4/brace-expansion": "^5.0.8",
-    "brace-expansion@npm:^5.0.2": "^5.0.8",
-    "brace-expansion@npm:^5.0.5": "^5.0.8",
-    "brace-expansion@npm:5.0.6": "^5.0.8",
+    "brace-expansion": "^5.0.8",
     "@appium/base-driver@npm:10.2.2/path-to-regexp": "^8.4.0",
     "router@npm:2.2.0/path-to-regexp": "^8.4.0",
     "yaml": "^2.8.3",
     "react-native-build-config@^0.3.2": "patch:react-native-build-config@npm%3A0.3.2#./.yarn/patches/react-native-build-config-npm-0.3.2-0e671629bd.patch",
-    "minimatch@npm:5.1.9/brace-expansion": "^2.1.2",
-    "minimatch@npm:8.0.7/brace-expansion": "^2.1.2",
-    "minimatch@npm:9.0.9/brace-expansion": "^2.1.2",
     "@expo/plist@npm:0.1.3/@xmldom/xmldom": "^0.8.13",
     "@expo/plist@npm:0.3.4/@xmldom/xmldom": "^0.8.13",
     "@expo/plist@npm:0.5.2/@xmldom/xmldom": "^0.8.13",
diff --git a/yarn.lock b/yarn.lock
index 33ee2b8ca3..00e406421c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -13131,13 +13131,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"balanced-match@npm:^1.0.0":
-  version: 1.0.2
-  resolution: "balanced-match@npm:1.0.2"
-  checksum: 10c0/9308baf0a7e4838a82bbfd11e01b1cb0f0cf2893bc1676c27c2a8c0e70cbae1c59120c3268517a8ae7fb6376b4639ef81ca22582611dbee4ed28df945134aaee
-  languageName: node
-  linkType: hard
-
 "balanced-match@npm:^4.0.2":
   version: 4.0.4
   resolution: "balanced-match@npm:4.0.4"
@@ -13384,25 +13377,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"brace-expansion@npm:^1.1.7":
-  version: 1.1.16
-  resolution: "brace-expansion@npm:1.1.16"
-  dependencies:
-    balanced-match: "npm:^1.0.0"
-    concat-map: "npm:0.0.1"
-  checksum: 10c0/b2a915bbedbf4e45840d1fb9a4d391bbf26a79475bd134714d3cee34f1f0edb0ce982738028843be5fbaf8039429f71fa487df8c915b6065ced542c83e58fae6
-  languageName: node
-  linkType: hard
-
-"brace-expansion@npm:^2.1.2":
-  version: 2.1.2
-  resolution: "brace-expansion@npm:2.1.2"
-  dependencies:
-    balanced-match: "npm:^1.0.0"
-  checksum: 10c0/5442ecab84045d21826268bc56c81a6ef4215327ee1f5ee153f67928e93f7a915d130ecec9966623143277fa3cce036ebb50020024bcc4d78853cdd6af9a19f8
-  languageName: node
-  linkType: hard
-
 "brace-expansion@npm:^5.0.8":
   version: 5.0.8
   resolution: "brace-expansion@npm:5.0.8"
@@ -14503,13 +14477,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"concat-map@npm:0.0.1":
-  version: 0.0.1
-  resolution: "concat-map@npm:0.0.1"
-  checksum: 10c0/c996b1cfdf95b6c90fee4dae37e332c8b6eb7d106430c17d538034c0ad9a1630cb194d2ab37293b1bdd4d779494beee7786d586a50bd9376fd6f7bcc2bd4c98f
-  languageName: node
-  linkType: hard
-
 "concat-stream@npm:^2.0.0":
   version: 2.0.0
   resolution: "concat-stream@npm:2.0.0"