Update brace-expansion (and remove glob) - #29101
Merged
Merged
Conversation
williammead
added
the
maintenance
Contributor
williammead
marked this pull request as ready for review
August 20, 2026 11:47
arelra
approved these changes
Aug 20, 2026
arelra
left a comment
arelra
left a comment
Member
There was a problem hiding this comment.
Great work 👏
The best kind of dependency upgrade is deleting it!
gu-prout
Bot
added
Pending-on-ADMIN-PROD
Pending-on-FRONTS-PROD
Seen-on-ADMIN-PROD
and removed
Pending-on-ADMIN-PROD
labels
|
Seen on ADMIN-PROD (merged by @williammead 9 minutes and 11 seconds ago)
|
|
Seen on FRONTS-PROD (merged by @williammead 11 minutes and 24 seconds ago)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the value of this and can you measure success?
We needed to update brace-expansion to the latest version (5.0.9) to fix a vulnerability.
fixes https://github.com/guardian/platform/issues/2318
As a bonus I have been able to remove our usage of the glob package.
What does this change?
As there are a few different dependencies which pull in different versions of brace-expansion there are a few things that need to happen to bring everything up to date.
1. Remove our use of the glob library, preferring instead to use node's
fs.globSync()The functionality of the glob package is achievable with the built in
fs.globSync()function. This function has a slightly different signature which means the parameters are slightly different and in order to have the paths returned as strings I filter the returned entries to make sure they are files and not directories before mapping them to strings.2. Update rimraf
Later versions of rimraf stopped using default exports so that's why its imports needed updating.
Related PR: Remove sass-graph package by removing the
make watchcommandThis work can be found here: #29106