From 655692316c1eb3fac2136aab8719d8b93603ba87 Mon Sep 17 00:00:00 2001 From: Andy Aragon Date: Wed, 29 Jul 2026 13:39:27 -0700 Subject: [PATCH] Fix version ranges for GHSA-mh99-v99m-4gvg (brace-expansion) The advisory declares a single range, introduced 0 -> fixed 5.0.8. The maintainer backported the fix to the 1.x, 2.x and 3.x lines after the advisory was published, so those lines now have patched releases that the current range still reports as affected. --- .../GHSA-mh99-v99m-4gvg.json | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json b/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json index 7bd33d93799a8..107f1e64d5b5e 100644 --- a/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json +++ b/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json @@ -27,6 +27,24 @@ { "introduced": "0" }, + { + "fixed": "1.1.17" + }, + { + "introduced": "2.0.0" + }, + { + "fixed": "2.1.3" + }, + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + }, + { + "introduced": "4.0.0" + }, { "fixed": "5.0.8" }