From dc0de03a1737be4bea50e0e8a662ff16ee586492 Mon Sep 17 00:00:00 2001
From: Aaron Elijah Mars <61592645+aaronjmars@users.noreply.github.com>
Date: Sat, 3 Oct 2026 10:50:28 -0400
Subject: [PATCH] fix(deps): patch brace-expansion in the extension

Raise the brace-expansion override from ^1.1.16 to ^1.1.21 so
web-ext > multimatch > minimatch@3 resolves 1.1.21, which fixes
GHSA-q2hr-2g5m-vwhr and the related brace-expansion DoS advisories.

node-forge (GHSA-86w9-cpqp-85rv) has no patched release yet; it comes
in via web-ext > @devicefarmer/adbkit, a dev-only tool, and adbkit
never calls the affected RSA signature verify path.
---
 opendia-extension/package-lock.json | 6 +++---
 opendia-extension/package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/opendia-extension/package-lock.json b/opendia-extension/package-lock.json
index 954665f..627b92e 100644
--- a/opendia-extension/package-lock.json
+++ b/opendia-extension/package-lock.json
@@ -789,9 +789,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.17.tgz",
-      "integrity": "sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/opendia-extension/package.json b/opendia-extension/package.json
index 60fa000..eb94db7 100644
--- a/opendia-extension/package.json
+++ b/opendia-extension/package.json
@@ -26,7 +26,7 @@
     "web-ext": "^10.7.0"
   },
   "overrides": {
-    "brace-expansion": "^1.1.16",
+    "brace-expansion": "^1.1.21",
     "shell-quote": "^1.9.0"
   }
 }