From 475ba18037cb39100d074e2f7fd200083f528d9c Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Sat, 10 Oct 2026 04:00:57 +0400
Subject: [PATCH] Resolve braces to @pezkuwi/braces 3.0.4 (CVE-2026-93687)

braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 7a5912e..b047894 100644
--- a/package.json
+++ b/package.json
@@ -47,6 +47,7 @@
     "@types/yargs": "^17.0.35"
   },
   "resolutions": {
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "typescript": "5.5.4"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index 87a6d18..d032bdf 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3395,12 +3395,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"braces@npm:^3.0.3":
-  version: 3.0.3
-  resolution: "braces@npm:3.0.3"
+"braces@npm:@pezkuwi/braces@^3.0.4":
+  version: 3.0.4
+  resolution: "@pezkuwi/braces@npm:3.0.4"
   dependencies:
     fill-range: "npm:^7.1.1"
-  checksum: 10/fad11a0d4697a27162840b02b1fad249c1683cbc510cd5bf1a471f2f8085c046d41094308c577a50a03a579dd99d5a6b3724c4b5e8b14df2c4443844cfcda2c6
+  checksum: 10/2f40d440686f51e9d6537900d5a34907e4a40143be6ed74c1de0a700388217352f1ea73c19af6f7cc379c0e62f887c23679430494c1fc974ff865e584aa26eea
   languageName: node
   linkType: hard