From e13045f3328cebdcdd17e60730923999babea0e4 Mon Sep 17 00:00:00 2001
From: "Jayanth Bujula (from Dev Box)" <jbujula@microsoft.com>
Date: Wed, 29 Jul 2026 15:40:40 -0700
Subject: [PATCH] Fix CVE-2026-33750: bump brace-expansion override 2.0.2 ->
 2.0.3

Resolves the S360 [SFI-ES5.2] 1ES Open Source Vulnerabilities action item
for Power Apps App Deployment (brace-expansion ReDoS, CVE-2026-33750).
Matches the remediation already present in powerplatform-build-tools.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: de0407b8-fb71-416c-8f0c-d03c0a7e0ef7
---
 package-lock.json | 9 +++------
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b1cf4c19..9711bb1a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2532,15 +2532,12 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.0.3",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/brace-expansion/-/brace-expansion-2.0.3.tgz",
+      "integrity": "sha1-BJMzi91Y4xmxA5xnz37kOYksAdk=",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
       }
     },
     "node_modules/braces": {
diff --git a/package.json b/package.json
index 022d496d..0fe20c8f 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "uuid": "^9.0.1"
   },
   "overrides": {
-    "brace-expansion": "2.0.2",
+    "brace-expansion": "2.0.3",
     "nanoid": "3.3.11"
   }
 }