From 70b5f5a210bc2b279258aa2855ddb5b7d11fcda5 Mon Sep 17 00:00:00 2001
From: SatoshiQaziMuhammed <info@pezkuwichain.io>
Date: Tue, 20 Oct 2026 22:51:16 +0400
Subject: [PATCH] fix(deps): resolve braces to the patched @pezkuwi/braces fork
 (#42)

`braces` <= 3.0.3 (GHSA-vfj7-8cjw-p6xm) has no upstream fix. `overrides.braces` points at `npm:@pezkuwi/braces@^3.0.4`, our patched fork, the same resolution pezkuwi-api already uses. Lockfile regenerated with `npm install --package-lock-only`; every `braces` entry now resolves to `@pezkuwi/braces` 3.0.4.

Open after this: `elliptic` <= 6.6.1 (GHSA-848j-6mx2-7j84) has no patched release yet.
---
 package-lock.json | 38 ++++++++++++++++++++++++++------------
 package.json      |  3 ++-
 2 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 25e9057..1f9007a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3956,18 +3956,6 @@
         "balanced-match": "^1.0.0"
       }
     },
-    "node_modules/braces": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
-      "license": "MIT",
-      "dependencies": {
-        "fill-range": "^7.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/brorand": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/brorand/-/brorand-1.1.0.tgz",
@@ -4342,6 +4330,19 @@
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/chokidar/node_modules/braces": {
+      "name": "@pezkuwi/braces",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@pezkuwi/braces/-/braces-3.0.4.tgz",
+      "integrity": "sha512-OIjlOoXiXRS7ZHusTkaKbPVldj3t63x3rxtgcqnokjJW1gqdlEnT4QcsqDjLBS0qY20ZVqqnQUSnB1k5UxqbFQ==",
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8.3"
+      }
+    },
     "node_modules/chokidar/node_modules/glob-parent": {
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
@@ -7531,6 +7532,19 @@
         "node": ">=8.6"
       }
     },
+    "node_modules/micromatch/node_modules/braces": {
+      "name": "@pezkuwi/braces",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@pezkuwi/braces/-/braces-3.0.4.tgz",
+      "integrity": "sha512-OIjlOoXiXRS7ZHusTkaKbPVldj3t63x3rxtgcqnokjJW1gqdlEnT4QcsqDjLBS0qY20ZVqqnQUSnB1k5UxqbFQ==",
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8.3"
+      }
+    },
     "node_modules/miller-rabin": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/miller-rabin/-/miller-rabin-4.0.1.tgz",
diff --git a/package.json b/package.json
index 27aa2f6..363be1b 100644
--- a/package.json
+++ b/package.json
@@ -91,6 +91,7 @@
   "overrides": {
     "axios": "^1.20.0",
     "ws": "^8.21.0",
-    "postcss-selector-parser": "^7.1.6"
+    "postcss-selector-parser": "^7.1.6",
+    "braces": "npm:@pezkuwi/braces@^3.0.4"
   }
 }