chore(deps): update dependency brace-expansion@<2 to v2 [security] by renovate[bot] · Pull Request #840 · ForgeRock/ping-javascript-sdk

renovate · 2026-09-10T21:08:31Z

This PR contains the following updates:

Package	Change	Age	Confidence
brace-expansion@<2	`~1.1.15` → `~2.1.2`

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp

More information

Details

Summary

brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consumers run on Node's single-threaded event loop, one small input can fully stall a worker/process.

In expand_, post is computed unconditionally at the top of the function, before the early-return branches that don't use it:

const post = m.post.length ? expand_(m.post, max, false) : [''];   // always recurses
  ...
if (!isSequence && !isOptions) {
  if (m.post.match(/,(?!,).*\}/)) {
    str = m.pre + '{' + m.body + escClose + m.post;
    return expand_(str, max, true); // restart — `post` discarded
  }
  return [str];
}

For input like a{},{},…, the first {} is non-expanding, so control reaches the {a},b} rewrite branch - but expand_ has already recursed into post over the entire remaining tail, only to throw the result away.
Each level therefore spawns two recursive expansions over essentially the same remaining work: T(n) = 2·T(n−1) ⇒ O(2ⁿ).

The max option does not mitigate this: max only bounds the output-building loops; neither the post recursion nor the rewrite recursion consults it.

Measured on 5.0.6:

groups (n)	input bytes	time
20	60	130 ms
24	72	1.9 s
26	78	7.8 s
30 (PoC)	90	~2 min

Proof of concept

const { expand } = require('brace-expansion');
// 30 non-expanding groups, ~90 bytes — blocks for minutes:
expand('a{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{}');

Impact

Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch/glob brace patterns - can be driven into a multi-minute-to-indefinite CPU hang by a tiny request, denying service on that thread/process.

Remediation

Upgrade to a patched release. The fix:

Defers computing post until after the early-return branches (and computes it locally in the $-suffix branch), so post is only expanded when a brace set actually expands and the value is used. This alone removes the exponential.
Converts the {a},b} rewrite from recursion to an in-function loop, so a long run of rewrites cannot grow the call stack.

Verified: the PoC drops from ~2 min to 0.55 ms, 5,000 groups complete in ~344 ms, and output is identical to 5.0.6 across a behavioral-equivalence suite (sequences, padding, $-prefix, a{},b}c, {},a}b, x{{a,b}}y, etc.). Post-fix complexity is ~O(n²) on this input class - acceptable for the security fix; a linear rewrite can be a non-urgent follow-up.

If immediate upgrade isn't possible, avoid passing untrusted input to expand() / glob brace patterns, or run such expansion under a timeout/worker.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

juliangruber/brace-expansion (brace-expansion@<2)

`v2.1.2`

Compare Source

`v2.1.1`

Compare Source

Backport v5.0.6 change to v2 (#109) c3a817c

pkg: publish on tag 2.x 14f1d91
fmt ed7780a
Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

`v2.0.1`

Compare Source

`v2.0.0`

Compare Source

`v1.1.21`

Compare Source

`v1.1.20`

Compare Source

`v1.1.19`

Compare Source

`v1.1.18`

Compare Source

`v1.1.17`

Compare Source

`v1.1.16`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-09-10T21:08:36Z

⚠️ No Changeset found

Latest commit: 22cfb5a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-09-10T21:08:55Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e304629e-e946-4e65-b59d-e35dfc34cde9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

nx-cloud · 2026-09-10T21:09:26Z

View your CI Pipeline Execution ↗ for commit 7407b6a

Command	Status	Duration	Result
`nx run-many -t build --no-agents`	✅ Succeeded	<1s	View ↗
`nx affected -t build lint test typecheck e2e-ci`	✅ Succeeded	46s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-09-24 20:44:40 UTC

pkg-pr-new · 2026-09-11T21:16:54Z

Open in StackBlitz

@forgerock/davinci-client

pnpm add https://pkg.pr.new/@forgerock/davinci-client@840

@forgerock/device-client

pnpm add https://pkg.pr.new/@forgerock/device-client@840

@forgerock/journey-client

pnpm add https://pkg.pr.new/@forgerock/journey-client@840

@forgerock/oidc-client

pnpm add https://pkg.pr.new/@forgerock/oidc-client@840

@forgerock/protect

pnpm add https://pkg.pr.new/@forgerock/protect@840

@forgerock/recognize

pnpm add https://pkg.pr.new/@forgerock/recognize@840

@forgerock/sdk-types

pnpm add https://pkg.pr.new/@forgerock/sdk-types@840

@forgerock/sdk-utilities

pnpm add https://pkg.pr.new/@forgerock/sdk-utilities@840

@forgerock/iframe-manager

pnpm add https://pkg.pr.new/@forgerock/iframe-manager@840

@forgerock/sdk-logger

pnpm add https://pkg.pr.new/@forgerock/sdk-logger@840

@forgerock/sdk-oidc

pnpm add https://pkg.pr.new/@forgerock/sdk-oidc@840

@forgerock/sdk-request-middleware

pnpm add https://pkg.pr.new/@forgerock/sdk-request-middleware@840

@forgerock/storage

pnpm add https://pkg.pr.new/@forgerock/storage@840

commit: 22cfb5a

github-actions · 2026-09-11T21:17:26Z

Deployed 2009fea to https://ForgeRock.github.io/ping-javascript-sdk/pr-840/2009fea0b457975543feee8d63dc39d453f73bb0 branch gh-pages in ForgeRock/ping-javascript-sdk

github-actions · 2026-09-11T21:17:36Z

📦 Bundle Size Analysis

🆕 New Packages

🆕 @forgerock/iframe-manager - 3.2 KB (new)
🆕 @forgerock/sdk-oidc - 5.8 KB (new)
🆕 @forgerock/sdk-logger - 1.6 KB (new)
🆕 @forgerock/storage - 1.5 KB (new)
🆕 @forgerock/sdk-request-middleware - 4.6 KB (new)
🆕 @forgerock/sdk-utilities - 18.8 KB (new)
🆕 @forgerock/protect - 144.6 KB (new)
🆕 @forgerock/oidc-client - 35.9 KB (new)
🆕 @forgerock/sdk-types - 9.1 KB (new)
🆕 @forgerock/recognize - 5605.5 KB (new)
🆕 @forgerock/device-client - 0.0 KB (new)
🆕 @forgerock/device-client - 10.3 KB (new)
🆕 @forgerock/journey-client - 0.0 KB (new)
🆕 @forgerock/journey-client - 95.4 KB (new)
🆕 @forgerock/davinci-client - 59.7 KB (new)

15 packages analyzed • Baseline from latest main build

Legend

🆕 New package
🔺 Size increased
🔻 Size decreased
➖ No change

ℹ️ How bundle sizes are calculated

Current Size: Total gzipped size of all files in the package's dist directory
Baseline: Comparison against the latest build from the main branch
Files included: All build outputs except source maps and TypeScript build cache
Exclusions: .map, .tsbuildinfo, and .d.ts.map files

_{🔄 Updated automatically on each push to this PR}

codecov-commenter · 2026-09-11T21:17:41Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.29%. Comparing base (eafe277) to head (22cfb5a).
⚠️ Report is 160 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #840       +/-   ##
===========================================
+ Coverage   18.07%   96.29%   +78.22%     
===========================================
  Files         155        1      -154     
  Lines       24398       81    -24317     
  Branches     1203       17     -1186     
===========================================
- Hits         4410       78     -4332     
+ Misses      19988        3    -19985

see 155 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

nx-cloud

Important

At least one additional CI pipeline execution has run since the conclusion below was written and it may no longer be applicable.

Nx Cloud has identified a possible root cause for your failed CI:

We investigated the failing @forgerock/oidc-suites:e2e-ci--src/logout.spec.ts task and confirmed it is a pre-existing environment issue: the PingAM test server is not rendering the login UI in time, and the identical failure is also present on main. Our PR's only change — a brace-expansion security patch — has no logical connection to PingAM server availability or Playwright E2E behavior.

No code changes were suggested for this issue.

Trigger a rerun:

View detailed reasoning on Nx Cloud ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}

github-actions · 2026-09-22T07:59:24Z

Interface Mapping Out of Date

The interface_mapping.md document is out of sync with the SDK exports.

Drift report

Extracting legacy SDK exports...
  Found 79 legacy exports
Extracting new SDK exports...
  Found 429 new SDK exports
Parsing interface_mapping.md...
  Found 143 documented mappings

Interface Mapping Drift Report
══════════════════════════════

Missing Callbacks (1)
  ✗ Callback "PingOneRecognizeCallback" from ./types is not documented in Callback Type Mapping

Undocumented New Exports (161)
  ⚠ New SDK export "makeJourneyConfig" from . is not referenced in the documentation
  ⚠ New SDK export "JourneyClient" from . is not referenced in the documentation
  ⚠ New SDK export "LogLevel" from . is not referenced in the documentation
  ⚠ New SDK export "CustomLogger" from . is not referenced in the documentation
  ⚠ New SDK export "RequestMiddleware" from . is not referenced in the documentation
  ⚠ New SDK export "ActionTypes" from . is not referenced in the documentation
  ⚠ New SDK export "GenericError" from . is not referenced in the documentation
  ⚠ New SDK export "WellknownResponse" from . is not referenced in the documentation
  ⚠ New SDK export "FailedPolicyRequirement" from . is not referenced in the documentation
  ⚠ New SDK export "PolicyParams" from . is not referenced in the documentation
  ⚠ New SDK export "isValidWellknownUrl" from . is not referenced in the documentation
  ⚠ New SDK export "createWellknownError" from . is not referenced in the documentation
  ⚠ New SDK export "DeviceProfileData" from . is not referenced in the documentation
  ⚠ New SDK export "Geolocation" from . is not referenced in the documentation
  ⚠ New SDK export "JourneyResult" from . is not referenced in the documentation
  ⚠ New SDK export "ResolvedServerConfig" from . is not referenced in the documentation
  ⚠ New SDK export "JourneyServerConfig" from . is not referenced in the documentation
  ⚠ New SDK export "JourneyClientConfig" from . is not referenced in the documentation
  ⚠ New SDK export "LegacyServerConfig" from . is not referenced in the documentation
  ⚠ New SDK export "InternalJourneyClientConfig" from . is not referenced in the documentation
  ⚠ New SDK export "StartParam" from . is not referenced in the documentation
  ⚠ New SDK export "ResumeOptions" from . is not referenced in the documentation
  ⚠ New SDK export "NextOptions" from . is not referenced in the documentation
  ⚠ New SDK export "CallbackFactory" from . is not referenced in the documentation
  ⚠ New SDK export "PingOneRecognizeOperationType" from . is not referenced in the documentation
  ⚠ New SDK export "PingOneRecognizeCallback" from . is not referenced in the documentation
  ⚠ New SDK export "CollectParameters" from ./device is not referenced in the documentation
  ⚠ New SDK export "DeviceProfileData" from ./device is not referenced in the documentation
  ⚠ New SDK export "Geolocation" from ./device is not referenced in the documentation
  ⚠ New SDK export "ProfileConfigOptions" from ./device is not referenced in the documentation
  ⚠ New SDK export "FailedPolicyRequirement" from ./policy is not referenced in the documentation
  ⚠ New SDK export "QRCodeData" from ./qr-code is not referenced in the documentation
  ⚠ New SDK export "LogLevel" from ./types is not referenced in the documentation
  ⚠ New SDK export "CustomLogger" from ./types is not referenced in the documentation
  ⚠ New SDK export "RequestMiddleware" from ./types is not referenced in the documentation
  ⚠ New SDK export "ActionTypes" from ./types is not referenced in the documentation
  ⚠ New SDK export "GenericError" from ./types is not referenced in the documentation
  ⚠ New SDK export "WellknownResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "FailedPolicyRequirement" from ./types is not referenced in the documentation
  ⚠ New SDK export "PolicyParams" from ./types is not referenced in the documentation
  ⚠ New SDK export "isValidWellknownUrl" from ./types is not referenced in the documentation
  ⚠ New SDK export "createWellknownError" from ./types is not referenced in the documentation
  ⚠ New SDK export "DeviceProfileData" from ./types is not referenced in the documentation
  ⚠ New SDK export "Geolocation" from ./types is not referenced in the documentation
  ⚠ New SDK export "JourneyResult" from ./types is not referenced in the documentation
  ⚠ New SDK export "ResolvedServerConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "JourneyClient" from ./types is not referenced in the documentation
  ⚠ New SDK export "JourneyServerConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "JourneyClientConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "LegacyServerConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "InternalJourneyClientConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "StartParam" from ./types is not referenced in the documentation
  ⚠ New SDK export "ResumeOptions" from ./types is not referenced in the documentation
  ⚠ New SDK export "NextOptions" from ./types is not referenced in the documentation
  ⚠ New SDK export "CallbackFactory" from ./types is not referenced in the documentation
  ⚠ New SDK export "PingOneRecognizeOperationType" from ./types is not referenced in the documentation
  ⚠ New SDK export "PingOneRecognizeCallback" from ./types is not referenced in the documentation
  ⚠ New SDK export "OutcomeWithName" from ./webauthn is not referenced in the documentation
  ⚠ New SDK export "AttestationType" from ./webauthn is not referenced in the documentation
  ⚠ New SDK export "UserVerificationType" from ./webauthn is not referenced in the documentation
  ⚠ New SDK export "makeOidcConfig" from . is not referenced in the documentation
  ⚠ New SDK export "PushAuthorizationResponse" from . is not referenced in the documentation
  ⚠ New SDK export "GenericError" from . is not referenced in the documentation
  ⚠ New SDK export "WellknownResponse" from . is not referenced in the documentation
  ⚠ New SDK export "ActionTypes" from . is not referenced in the documentation
  ⚠ New SDK export "RequestMiddleware" from . is not referenced in the documentation
  ⚠ New SDK export "CustomLogger" from . is not referenced in the documentation
  ⚠ New SDK export "LogLevel" from . is not referenced in the documentation
  ⚠ New SDK export "BrowserStorageConfig" from . is not referenced in the documentation
  ⚠ New SDK export "CustomStorageConfig" from . is not referenced in the documentation
  ⚠ New SDK export "StorageConfig" from . is not referenced in the documentation
  ⚠ New SDK export "CustomStorageObject" from . is not referenced in the documentation
  ⚠ New SDK export "createClientStore" from . is not referenced in the documentation
  ⚠ New SDK export "OidcClient" from . is not referenced in the documentation
  ⚠ New SDK export "ClientStore" from . is not referenced in the documentation
  ⚠ New SDK export "RootState" from . is not referenced in the documentation
  ⚠ New SDK export "AppDispatch" from . is not referenced in the documentation
  ⚠ New SDK export "RevokeSuccessResult" from . is not referenced in the documentation
  ⚠ New SDK export "RevokeErrorResult" from . is not referenced in the documentation
  ⚠ New SDK export "LogoutSuccessResult" from . is not referenced in the documentation
  ⚠ New SDK export "LogoutErrorResult" from . is not referenced in the documentation
  ⚠ New SDK export "UserInfoResponse" from . is not referenced in the documentation
  ⚠ New SDK export "OidcConfig" from . is not referenced in the documentation
  ⚠ New SDK export "BuildAuthorizationData" from . is not referenced in the documentation
  ⚠ New SDK export "OptionalAuthorizeOptions" from . is not referenced in the documentation
  ⚠ New SDK export "AuthorizeErrorResponse" from . is not referenced in the documentation
  ⚠ New SDK export "AuthorizeSuccessResponse" from . is not referenced in the documentation
  ⚠ New SDK export "AuthorizationSuccess" from . is not referenced in the documentation
  ⚠ New SDK export "AuthorizationError" from . is not referenced in the documentation
  ⚠ New SDK export "TokenExchangeResponse" from . is not referenced in the documentation
  ⚠ New SDK export "TokenExchangeErrorResponse" from . is not referenced in the documentation
  ⚠ New SDK export "TokenRequestOptions" from . is not referenced in the documentation
  ⚠ New SDK export "SessionCheckResponseType" from . is not referenced in the documentation
  ⚠ New SDK export "SessionCheckOptions" from . is not referenced in the documentation
  ⚠ New SDK export "SessionCheckSuccess" from . is not referenced in the documentation
  ⚠ New SDK export "PushAuthorizationResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "GenericError" from ./types is not referenced in the documentation
  ⚠ New SDK export "WellknownResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "ActionTypes" from ./types is not referenced in the documentation
  ⚠ New SDK export "RequestMiddleware" from ./types is not referenced in the documentation
  ⚠ New SDK export "CustomLogger" from ./types is not referenced in the documentation
  ⚠ New SDK export "LogLevel" from ./types is not referenced in the documentation
  ⚠ New SDK export "BrowserStorageConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "CustomStorageConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "StorageConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "CustomStorageObject" from ./types is not referenced in the documentation
  ⚠ New SDK export "createClientStore" from ./types is not referenced in the documentation
  ⚠ New SDK export "OidcClient" from ./types is not referenced in the documentation
  ⚠ New SDK export "ClientStore" from ./types is not referenced in the documentation
  ⚠ New SDK export "RootState" from ./types is not referenced in the documentation
  ⚠ New SDK export "AppDispatch" from ./types is not referenced in the documentation
  ⚠ New SDK export "RevokeSuccessResult" from ./types is not referenced in the documentation
  ⚠ New SDK export "RevokeErrorResult" from ./types is not referenced in the documentation
  ⚠ New SDK export "LogoutSuccessResult" from ./types is not referenced in the documentation
  ⚠ New SDK export "LogoutErrorResult" from ./types is not referenced in the documentation
  ⚠ New SDK export "UserInfoResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "OidcConfig" from ./types is not referenced in the documentation
  ⚠ New SDK export "BuildAuthorizationData" from ./types is not referenced in the documentation
  ⚠ New SDK export "OptionalAuthorizeOptions" from ./types is not referenced in the documentation
  ⚠ New SDK export "AuthorizeErrorResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "AuthorizeSuccessResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "AuthorizationSuccess" from ./types is not referenced in the documentation
  ⚠ New SDK export "AuthorizationError" from ./types is not referenced in the documentation
  ⚠ New SDK export "TokenExchangeResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "TokenExchangeErrorResponse" from ./types is not referenced in the documentation
  ⚠ New SDK export "TokenRequestOptions" from ./types is not referenced in the documentation
  ⚠ New SDK export "SessionCheckResponseType" from ./types is not referenced in the documentation
  ⚠ New SDK export "SessionCheckOptions" from ./types is not referenced in the documentation
  ⚠ New SDK export "SessionCheckSuccess" from ./types is not referenced in the documentation
  ⚠ New SDK export "DeviceClient" from . is not referenced in the documentation
  ⚠ New SDK export "OathDevice" from . is not referenced in the documentation
  ⚠ New SDK export "DeleteOathQuery" from . is not referenced in the documentation
  ⚠ New SDK export "RetrieveOathQuery" from . is not referenced in the documentation
  ⚠ New SDK export "OathResponse" from . is not referenced in the documentation
  ⚠ New SDK export "DeletedOathDevice" from . is not referenced in the documentation
  ⚠ New SDK export "WebAuthnQuery" from . is not referenced in the documentation
  ⚠ New SDK export "WebAuthnBody" from . is not referenced in the documentation
  ⚠ New SDK export "WebAuthnDevice" from . is not referenced in the documentation
  ⚠ New SDK export "UpdatedWebAuthnDevice" from . is not referenced in the documentation
  ⚠ New SDK export "WebAuthnCredential" from . is not referenced in the documentation
  ⚠ New SDK export "GetProfileDevices" from . is not referenced in the documentation
  ⚠ New SDK export "ProfileDevicesQuery" from . is not referenced in the documentation
  ⚠ New SDK export "ProfileDevice" from . is not referenced in the documentation
  ⚠ New SDK export "PushDeviceQuery" from . is not referenced in the documentation
  ⚠ New SDK export "PushDeviceBody" from . is not referenced in the documentation
  ⚠ New SDK export "DeleteDeviceQuery" from . is not referenced in the documentation
  ⚠ New SDK export "DeviceInfoResponse" from . is not referenced in the documentation
  ⚠ New SDK export "DeviceInfo" from . is not referenced in the documentation
  ⚠ New SDK export "PushDevice" from . is not referenced in the documentation
  ⚠ New SDK export "DeletedPushDevice" from . is not referenced in the documentation
  ⚠ New SDK export "GetBoundDevicesQuery" from . is not referenced in the documentation
  ⚠ New SDK export "BoundDeviceQuery" from . is not referenced in the documentation
  ⚠ New SDK export "DeviceResponse" from . is not referenced in the documentation
  ⚠ New SDK export "DeviceMetadata" from . is not referenced in the documentation
  ⚠ New SDK export "Hardware" from . is not referenced in the documentation
  ⚠ New SDK export "Browser" from . is not referenced in the documentation
  ⚠ New SDK export "Bluetooth" from . is not referenced in the documentation
  ⚠ New SDK export "Network" from . is not referenced in the documentation
  ⚠ New SDK export "Telephony" from . is not referenced in the documentation
  ⚠ New SDK export "Metadata" from . is not referenced in the documentation
  ⚠ New SDK export "DeviceProfile" from . is not referenced in the documentation

Summary: 1 error, 161 warnings

To fix, run:

pnpm mapping:generate

Then commit the updated interface_mapping.md.

renovate Bot added the dependencies label Sep 10, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 96253f9 to e923cac Compare September 10, 2026 21:11

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 10, 2026

This comment was marked as outdated.

Sign in to view

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from e923cac to e553f2e Compare September 11, 2026 19:47

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 11, 2026

This comment was marked as outdated.

Sign in to view

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from e553f2e to a56e82f Compare September 11, 2026 20:02

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 11, 2026

This comment was marked as outdated.

Sign in to view

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from a56e82f to a5c223c Compare September 11, 2026 20:10

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 11, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from a5c223c to d9bfaa9 Compare September 11, 2026 20:12

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 11, 2026

This comment was marked as outdated.

Sign in to view

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from d9bfaa9 to ca7a638 Compare September 11, 2026 21:10

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 11, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from ca7a638 to 2a610d4 Compare September 11, 2026 21:12

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 11, 2026

This comment was marked as outdated.

Sign in to view

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 2a610d4 to 175a31f Compare September 11, 2026 21:34

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from c71d6d4 to 27c48aa Compare September 16, 2026 18:25

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 16, 2026

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 17, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch 2 times, most recently from 48cb50f to cfff49e Compare September 17, 2026 20:18

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 17, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from cfff49e to a9508c1 Compare September 18, 2026 20:32

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 18, 2026

This comment was marked as outdated.

Sign in to view

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from a9508c1 to 42ecb9f Compare September 18, 2026 21:04

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 18, 2026

nx-cloud Bot reviewed Sep 18, 2026

View reviewed changes

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 42ecb9f to bcfc54f Compare September 18, 2026 23:14

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 18, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from bcfc54f to 7c80d9b Compare September 18, 2026 23:16

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 18, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 7c80d9b to 4317196 Compare September 22, 2026 07:46

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 22, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 4317196 to d21b9af Compare September 22, 2026 07:53

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 22, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from d21b9af to f96a839 Compare September 23, 2026 22:37

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 23, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from f96a839 to 8e0257c Compare September 23, 2026 22:43

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 23, 2026

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 8e0257c to 7407b6a Compare September 24, 2026 20:36

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v2 [security]~~ chore(deps): update dependency brace-expansion@<2 to v5 [security] Sep 24, 2026

chore(deps): update dependency brace-expansion@<2 to v2 [security]

22cfb5a

renovate Bot force-pushed the renovate/npm-brace-expansion-2-vulnerability branch from 7407b6a to 22cfb5a Compare September 24, 2026 20:41

renovate Bot changed the title ~~chore(deps): update dependency brace-expansion@<2 to v5 [security]~~ chore(deps): update dependency brace-expansion@<2 to v2 [security] Sep 24, 2026

Conversation

renovate Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Details

Summary

Proof of concept

Impact

Remediation

Severity

References

Release Notes

Configuration

Uh oh!

changeset-bot Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

nx-cloud Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

pkg-pr-new Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Bundle Size Analysis

📦 Bundle Size Analysis

🆕 New Packages

Legend

Uh oh!

codecov-commenter commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

Uh oh!

nx-cloud Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Nx Cloud has identified a possible root cause for your failed CI:

Uh oh!

github-actions Bot commented Sep 22, 2026

Interface Mapping Out of Date

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Sep 10, 2026 •

edited

Loading

changeset-bot Bot commented Sep 10, 2026 •

edited

Loading

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

nx-cloud Bot commented Sep 10, 2026 •

edited

Loading

pkg-pr-new Bot commented Sep 11, 2026 •

edited

Loading

github-actions Bot commented Sep 11, 2026 •

edited

Loading

github-actions Bot commented Sep 11, 2026 •

edited

Loading

codecov-commenter commented Sep 11, 2026 •

edited

Loading

nx-cloud Bot left a comment •

edited

Loading