Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Remove the braces audit allowlist entry once nodemon moves to chokidar 4

Open
  • Is something wrong?
#413 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
15/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript, nodejs
Domain
security, tooling

Research direction

The work is the GHSA-vfj7-8cjw-p6xm entry in ALLOWLIST in scripts/audit-check.cjs, plus its bullet under "Accepted / deferred security risks" in CLAUDE.md. Do not start yet: the issue waits on a new nodemon release that depends on chokidar 4, or a fixed braces version, and neither exists. Confirm the upstream state with npm view braces version and npm view nodemon dependencies. Done means the entry and bullet are removed in the same change as the upgrade, and npm audit still passes.

Written by the indexing model from the issue text.

Description

dependencies priority: low tech-debt

Tracking issue for the single entry now in the scripts/audit-check.cjs allowlist, added in #402. Same pattern as #348.

The entry

GHSA-vfj7-8cjw-p6xm — braces stack-exhaustion DoS via deeply nested patterns (high).

Reachable only as nodemon → chokidar → braces, and there is no fix to take:

  • [email protected] is the latest published release.
  • nodemon (at ^3.1.14, itself the latest) pins chokidar ^3. chokidar 4 dropped glob support, so it is not a drop-in replacement for nodemon's use.

Accepted because it is dev-only and unreachable in production: npm ls braces --omit=dev returns empty, and the only globs that watcher ever parses are our own nodemon watch patterns — never attacker input.

What to do, and when

Per CLAUDE.md's rule ("when an accepted advisory gains a fix, upgrade and remove the entry"), revisit when either:

  • nodemon ships a release depending on chokidar ^4 (or otherwise drops braces), or
  • braces publishes a fixed version.

Then upgrade, delete the entry from ALLOWLIST in scripts/audit-check.cjs, and remove the corresponding bullet from CLAUDE.md's "Accepted / deferred security risks".

Note on #348

#348 tracks the react-router allowlist entry (GHSA-qwww-vcr4-c8h2). That entry is already gone — it was dropped when react-router-dom 7.18.2 shipped the fix, and the allowlist was empty before #402 added this one. #348 looks closeable.

Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
8m
Merged PRs (30d)
8

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from LeeAdcock/robocodeJs.com

All issues in LeeAdcock/robocodeJs.com

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.