Skip to content

Commit

Permalink
fix: remove vulnerable dependency expand-braces (#3270)
Browse files Browse the repository at this point in the history
Remove `expand-braces` as a dependency. Use `braces.expand` instead
now.

Fixes #3268
Fixes #3269
  • Loading branch information
SteinRobert authored and johnjbarton committed Feb 19, 2019
1 parent d5df723 commit 4ec4f6f
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 3 deletions.
8 changes: 6 additions & 2 deletions lib/watcher.js
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
'use strict'

const mm = require('minimatch')
const expandBraces = require('expand-braces')
const braces = require('braces')
const PatternUtils = require('./utils/pattern-utils')

const helper = require('./helper')
Expand All @@ -10,7 +10,11 @@ const log = require('./logger').create('watcher')
const DIR_SEP = require('path').sep

function watchPatterns (patterns, watcher) {
expandBraces(patterns) // expand ['a/{b,c}'] to ['a/b', 'a/c']
let expandedPatterns = []
patterns.map((pattern) => {
expandedPatterns = expandedPatterns.concat(braces.expand(pattern)) // expand ['a/{b,c}'] to ['a/b', 'a/c']
})
expandedPatterns
.map(PatternUtils.getBaseDir)
.filter((path, index, paths) => paths.indexOf(path) === index) // filter unique values
.forEach((path, index, paths) => {
Expand Down
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -380,14 +380,14 @@
"dependencies": {
"bluebird": "^3.3.0",
"body-parser": "^1.16.1",
"braces": "^2.3.2",
"chokidar": "^2.0.3",
"colors": "^1.1.0",
"combine-lists": "^1.0.0",
"connect": "^3.6.0",
"core-js": "^2.2.0",
"di": "^0.0.1",
"dom-serialize": "^2.2.0",
"expand-braces": "^0.1.1",
"flatted": "^2.0.0",
"glob": "^7.1.1",
"graceful-fs": "^4.1.2",
Expand Down

0 comments on commit 4ec4f6f

Please sign in to comment.