Merge pull request #174 from ethena-labs/security/high-brace-jsyaml-aiohttp

fix(deps): pin brace-expansion, js-yaml, and aiohttp>=3.14.3

Author: FJ-Riveros

package.json

@@ -17,10 +17,10 @@
     "@solana/web3.js": "^1.95.2",
     "axios": "^1.18.0",
     "base-x": "^3.0.11",
-    "brace-expansion": "^5.0.8",
+    "brace-expansion": "^5.0.9",
     "dotenv": "^16.4.5",
     "form-data": "^4.0.6",
-    "js-yaml": "^3.15.0"
+    "js-yaml": "^3.15.1"
   },
   "packageManager": "pnpm@11.3.0",
   "engines": {

pnpm-lock.yaml

@@ -9,6 +9,12 @@ minimumReleaseAge: 14400
 # TODO(2026-08-10): drop this once ip-address@10.4.0 clears minimumReleaseAge
 # (published 2026-07-31; 10-day gate ⇒ ~2026-08-10).
 minimumReleaseAgeExclude:
+  # TEMPORARY excludes (~remove once these patched versions clear the 10-day age
+  # gate, ~2026-08-20): version-scoped so ONLY these exact security-patched
+  # versions bypass minimumReleaseAge — every other version still gets the age
+  # check. The `overrides` below are the permanent pins; only these are temporary.
+  - js-yaml@3.15.1 || 4.3.1 || 5.2.2
+  - brace-expansion@1.1.18 || 2.1.4 || 3.0.6 || 5.0.9
   - ip-address@10.4.0
 # Fail (don't silently downgrade) if a package's publisher trust level drops
 trustPolicy: no-downgrade
@@ -36,10 +42,9 @@ overrides:
   "axios": ">=1.18.0"
   "axios@1.14.1": ">=1.18.0"
   "axios@0.30.4": "0.30.3"
-  "brace-expansion@<1.1.16": "1.1.16"
-  "brace-expansion@>=2.0.0 <2.1.2": "2.1.2"
+
   # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.x
-  "brace-expansion@>=3.0.0 <5.0.8": "5.0.8"
+
   "ip-address@<=10.1.0": "10.1.1"
   "uuid@11.1.0": "11.1.1"
   "ws@>=7.0.0 <7.5.11": "7.5.11"
@@ -50,6 +55,13 @@ overrides:
   "base-x": "^5.0.1"
   "@tootallnate/once": ">=3.0.1"
 
+  "brace-expansion@<1.1.18": "1.1.18"
+  "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
+  "brace-expansion@>=3.0.0 <3.0.6": "3.0.6"
+  "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"
+  "js-yaml@>=3.0.0 <3.15.1": "3.15.1"
+  "js-yaml@>=4.0.0 <4.3.1": "4.3.1"
+  "js-yaml@>=5.0.0 <=5.2.1": "5.2.2"
 # Dependencies permitted to run install/build scripts.
 allowBuilds:
   bigint-buffer-fixed: true # native, replaces bigint-buffer via override

pnpm-workspace.yaml

@@ -22,10 +22,10 @@ dev = [
 [tool.uv]
 exclude-newer = "10 days"
 override-dependencies = [
-    "aiohttp>=3.14.1",  # CVE-2026-34993, CVE-2026-47265, CVE-2026-54273/54274/54276/54277/54278
     "Pygments>=2.20.0",
     "urllib3>=2.7.0",
-    "idna>=3.15",  # CVE-2026-45409
+    "idna>=3.15",
+    "aiohttp>=3.14.3",
 ]
 
 [tool.ruff]