From 89a9b89e16d6325be3da8fb3d582b9abbe58499a Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 1 Oct 2026 12:23:01 +0530 Subject: [PATCH 1/5] fix vulnerability --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3b64083..2b61028 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1720,9 +1720,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.10", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.10.tgz", + "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index fc93226..eb9e5a5 100644 --- a/package.json +++ b/package.json @@ -43,7 +43,7 @@ "flatted": "^3.4.2", "picomatch": "2.3.2", "serialize-javascript": "6.0.2", - "brace-expansion": "5.0.8", + "brace-expansion": "5.0.10", "lodash": "4.18.0", "uuid": "14.0.0", "js-yaml": "4.3.1", From 7af3c93f0e1dcb70d8df7262f38147bfe6c84020 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 1 Oct 2026 12:33:36 +0530 Subject: [PATCH 2/5] fix vul --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2b61028..8372688 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1720,9 +1720,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.10", - "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.10.tgz", - "integrity": "sha512-vtQmMo9msrxeVAcr4/Gz6FbFLIrKMiuH6t3JOG6dodLkwLVdidWTZEjrIwICymzq2FDZ2Pp+S11ifm1EwDLTiA==", + "version": "5.0.11", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.11.tgz", + "integrity": "sha512-awigjhi6cLTh90bdw6+QJ9CtmJmyYhEIi70iCbc8Rozn04Fw9FeQIBjv/E22FFGuCGx1bLJyUfB64x/szUSXUg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index eb9e5a5..1884428 100644 --- a/package.json +++ b/package.json @@ -43,7 +43,7 @@ "flatted": "^3.4.2", "picomatch": "2.3.2", "serialize-javascript": "6.0.2", - "brace-expansion": "5.0.10", + "brace-expansion": "5.0.11", "lodash": "4.18.0", "uuid": "14.0.0", "js-yaml": "4.3.1", From b9824863474691ed151fdcecb11c878f7e8d2fb0 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 1 Oct 2026 12:45:51 +0530 Subject: [PATCH 3/5] fix vul --- package-lock.json | 30 ++++++++++++++++-------------- package.json | 4 +++- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8372688..e636cee 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1697,14 +1697,11 @@ } }, "node_modules/balanced-match": { - "version": "4.0.4", - "resolved": "https://packages.echohq.com/artifactory/api/npm/npm/balanced-match/-/balanced-match-4.0.4.tgz", - "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "version": "1.0.2", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", "dev": true, - "license": "MIT", - "engines": { - "node": "18 || 20 || >=22" - } + "license": "MIT" }, "node_modules/baseline-browser-mapping": { "version": "2.11.14", @@ -1720,16 +1717,14 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.11", - "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-5.0.11.tgz", - "integrity": "sha512-awigjhi6cLTh90bdw6+QJ9CtmJmyYhEIi70iCbc8Rozn04Fw9FeQIBjv/E22FFGuCGx1bLJyUfB64x/szUSXUg==", + "version": "1.1.21", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { - "balanced-match": "^4.0.2" - }, - "engines": { - "node": "20 || >=22" + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" } }, "node_modules/braces": { @@ -1950,6 +1945,13 @@ "dev": true, "license": "MIT" }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", + "dev": true, + "license": "MIT" + }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://packages.echohq.com/artifactory/api/npm/npm/convert-source-map/-/convert-source-map-2.0.0.tgz", diff --git a/package.json b/package.json index 1884428..6b44821 100644 --- a/package.json +++ b/package.json @@ -43,7 +43,9 @@ "flatted": "^3.4.2", "picomatch": "2.3.2", "serialize-javascript": "6.0.2", - "brace-expansion": "5.0.11", + "brace-expansion@1": "1.1.21", + "brace-expansion@2": "2.1.7", + "brace-expansion@5": "5.0.12", "lodash": "4.18.0", "uuid": "14.0.0", "js-yaml": "4.3.1", From b56b5ee59cf98b0ee3549afa75e09575d132b194 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 1 Oct 2026 13:22:59 +0530 Subject: [PATCH 4/5] fix vulner --- package.json | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/package.json b/package.json index 6b44821..7a39a39 100644 --- a/package.json +++ b/package.json @@ -43,9 +43,7 @@ "flatted": "^3.4.2", "picomatch": "2.3.2", "serialize-javascript": "6.0.2", - "brace-expansion@1": "1.1.21", - "brace-expansion@2": "2.1.7", - "brace-expansion@5": "5.0.12", + "brace-expansion": "1.1.21", "lodash": "4.18.0", "uuid": "14.0.0", "js-yaml": "4.3.1", From 3d3e6f879251acdbaceb0e78d645d85809fc71bd Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 1 Oct 2026 18:16:10 +0530 Subject: [PATCH 5/5] fix vul and test --- src/tests/ResultTest.test.ts | 2 +- src/tests/data/package-lock.json | 6 +++--- src/tests/data/package.json | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/tests/ResultTest.test.ts b/src/tests/ResultTest.test.ts index c282ab2..f77755a 100644 --- a/src/tests/ResultTest.test.ts +++ b/src/tests/ResultTest.test.ts @@ -60,7 +60,7 @@ describe("Results cases",() => { it('Result codebashing successful case', async () => { const auth = new CxWrapper(cxScanConfig); - const cxCommandOutput: CxCommandOutput = await auth.codeBashingList("79","PHP","Reflected XSS All Clients"); + const cxCommandOutput: CxCommandOutput = await auth.codeBashingList("79","PHP","Reflected_XSS"); expect(cxCommandOutput.payload.length).toBeGreaterThan(0); }); diff --git a/src/tests/data/package-lock.json b/src/tests/data/package-lock.json index 5e25ac0..5140cef 100644 --- a/src/tests/data/package-lock.json +++ b/src/tests/data/package-lock.json @@ -938,7 +938,7 @@ "license": "ISC" }, "node_modules/brace-expansion": { - "version": "1.1.11", + "version": "1.1.21", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -963,7 +963,7 @@ "license": "ISC" }, "node_modules/browserslist": { - "version": "4.22.3", + "version": "4.28.7", "dev": true, "funding": [ { @@ -3233,7 +3233,7 @@ "license": "ISC" }, "node_modules/nanoid": { - "version": "3.3.3", + "version": "3.3.17", "dev": true, "license": "MIT", "bin": { diff --git a/src/tests/data/package.json b/src/tests/data/package.json index 62aabac..6b32f7c 100644 --- a/src/tests/data/package.json +++ b/src/tests/data/package.json @@ -770,7 +770,10 @@ "webpack-cli": "^4.10.0" }, "overrides": { - "bluebird": "3.7.2" + "bluebird": "3.7.2", + "nanoid": "3.3.17", + "browserslist": "4.28.7", + "brace-expansion": "1.1.21" }, "displayName": "Checkmarx", "engines": {