chore(deps): Update dependency braces to version 3.0.3 🌟

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
braces	2.3.2 → 3.0.3

---

Uncontrolled resource consumption in braces

CVE-2024-4068 / GHSA-grv7-fg5c-xmjg

More information

Details

The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-4068
• https://github.com/micromatch/braces/issues/35
• https://devhub.checkmarx.com/cve-details/CVE-2024-4068
• https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308
• https://github.com/micromatch/braces/pull/37
• https://github.com/micromatch/braces/pull/40
• https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
• https://github.com/advisories/GHSA-grv7-fg5c-xmjg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

micromatch/braces (braces)

v3.0.3

Compare Source

v3.0.2

Compare Source

v3.0.1

Compare Source

v3.0.0

Compare Source

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

• The undocumented .makeRe method was removed
• Require Node.js >= 8.3

Non-breaking changes

• Caching was removed

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.