From 5f4042b6040873e7017d0bec8e6e89c725faee5f Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Sat, 10 Oct 2026 03:37:26 +0400
Subject: [PATCH] Resolve braces to @pezkuwi/braces 3.0.4

braces 3.0.3, the latest upstream release, has an open advisory with no
fixed version (CVE-2026-93687: deeply nested patterns exhaust the stack
in its recursive AST walkers). @pezkuwi/braces is a fork that rejects
nesting deeper than maxDepth (500) with a SyntaxError; its tests include
the upstream suite.
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 6bbe197c7..211aa2a30 100644
--- a/package.json
+++ b/package.json
@@ -46,6 +46,7 @@
   },
   "resolutions": {
     "axios": "^1.20.0",
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "semver": "^7.5.2",
     "typescript": "^5.5.4"
   }
diff --git a/yarn.lock b/yarn.lock
index a8646ced9..e20566fc4 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3153,12 +3153,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"braces@npm:^3.0.3":
-  version: 3.0.3
-  resolution: "braces@npm:3.0.3"
+"braces@npm:@pezkuwi/braces@^3.0.4":
+  version: 3.0.4
+  resolution: "@pezkuwi/braces@npm:3.0.4"
   dependencies:
     fill-range: "npm:^7.1.1"
-  checksum: 10/fad11a0d4697a27162840b02b1fad249c1683cbc510cd5bf1a471f2f8085c046d41094308c577a50a03a579dd99d5a6b3724c4b5e8b14df2c4443844cfcda2c6
+  checksum: 10/2f40d440686f51e9d6537900d5a34907e4a40143be6ed74c1de0a700388217352f1ea73c19af6f7cc379c0e62f887c23679430494c1fc974ff865e584aa26eea
   languageName: node
   linkType: hard