From ddfc687bf5d2de5d0ddd9d956e0de66832515e29 Mon Sep 17 00:00:00 2001
From: Tom Thelen <33458285+TechPro01@users.noreply.github.com>
Date: Wed, 29 Jul 2026 17:45:40 -0400
Subject: [PATCH] Correct brace-expansion version ranges: fix was backported to
 1.x, 2.x and 3.x

The single range (introduced 0, fixed 5.0.8) reports 1.1.17, 2.1.3, 3.0.3,
3.0.4 and 3.0.5 as vulnerable, but all five carry the fix. Split into
per-branch ranges. 4.x has no patched release, so its range continues to
5.0.8.
---
 .../GHSA-mh99-v99m-4gvg.json                   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json b/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json
index 7bd33d93799a8..107f1e64d5b5e 100644
--- a/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json
+++ b/advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json
@@ -27,6 +27,24 @@
             {
               "introduced": "0"
             },
+            {
+              "fixed": "1.1.17"
+            },
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.1.3"
+            },
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.0.3"
+            },
+            {
+              "introduced": "4.0.0"
+            },
             {
               "fixed": "5.0.8"
             }