[PR #42] [MERGED] fix: upgrade braces to 3.0.3 (CVE-2024-4068) #41

New issue

Closed

opened 2026-10-29 14:32:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:32:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/kvcache-blog/pull/42
Author: @anupamme
Created: 9/3/2026
Status: ✅ Merged
Merged: 9/11/2026
Merged by: @ykwd

Base: main ← Head: fix-repo-kvcache-blog-cve-2024-4068-braces-v2

📝 Commits (3)

5555648 fix(deps): upgrade braces to 3.0.3 via pnpm override for CVE-2024-4068
aba3294 docs(blox-tailwind): align README with pnpm-specific override config
9e74f21 fix(blox-tailwind): move braces override to pnpm-workspace.yaml

📊 Changes

3 files changed (+17 additions, -10 deletions)

View changed files

📝 hugo-blox/blox-tailwind/README.md (+3 -1)
📝 hugo-blox/blox-tailwind/pnpm-lock.yaml (+12 -9)
➕ hugo-blox/blox-tailwind/pnpm-workspace.yaml (+2 -0)

📄 Description

Summary

Upgrade braces from 3.0.2 to 3.0.3 to fix CVE-2024-4068.

Vulnerability

Field	Value
ID	CVE-2024-4068
Severity	HIGH
Scanner	trivy
Rule	`CVE-2024-4068`
File	`hugo-blox/blox-tailwind/pnpm-lock.yaml` (dependency: `braces`)
Assessment	Present in dependency tree, not confirmed reachable

Description: braces: fails to limit the number of characters it can handle

Evidence

Scanner confirmation: trivy rule CVE-2024-4068 flagged this pattern.

Changes

hugo-blox/blox-tailwind/package.json
hugo-blox/blox-tailwind/pnpm-lock.yaml

Behavior Preservation

This change touches only dependency manifests (hugo-blox/blox-tailwind/package.json, hugo-blox/blox-tailwind/pnpm-lock.yaml); no source file in the repository is modified.

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

Automated security fix by OrbisAI Security

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/kvcache-blog/pull/42 **Author:** [@anupamme](https://github.com/anupamme) **Created:** 9/3/2026 **Status:** ✅ Merged **Merged:** 9/11/2026 **Merged by:** [@ykwd](https://github.com/ykwd) **Base:** `main` ← **Head:** `fix-repo-kvcache-blog-cve-2024-4068-braces-v2` --- ### 📝 Commits (3) - [`5555648`](https://github.com/kvcache-ai/kvcache-blog/commit/555564849552d6e4551a56be76153fe3e1866398) fix(deps): upgrade braces to 3.0.3 via pnpm override for CVE-2024-4068 - [`aba3294`](https://github.com/kvcache-ai/kvcache-blog/commit/aba32941f1f279c7ee75f9ee73ad39d05c886fa1) docs(blox-tailwind): align README with pnpm-specific override config - [`9e74f21`](https://github.com/kvcache-ai/kvcache-blog/commit/9e74f218fdab6b0c61feb2134db80b1f6b08d2c7) fix(blox-tailwind): move braces override to pnpm-workspace.yaml ### 📊 Changes **3 files changed** (+17 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `hugo-blox/blox-tailwind/README.md` (+3 -1) 📝 `hugo-blox/blox-tailwind/pnpm-lock.yaml` (+12 -9) ➕ `hugo-blox/blox-tailwind/pnpm-workspace.yaml` (+2 -0) </details> ### 📄 Description ## Summary Upgrade braces from 3.0.2 to 3.0.3 to fix CVE-2024-4068. ## Vulnerability | Field | Value | |-------|-------| | **ID** | CVE-2024-4068 | | **Severity** | HIGH | | **Scanner** | trivy | | **Rule** | `CVE-2024-4068` | | **File** | `hugo-blox/blox-tailwind/pnpm-lock.yaml` (dependency: `braces`) | | **Assessment** | Present in dependency tree, not confirmed reachable | **Description**: braces: fails to limit the number of characters it can handle ## Evidence **Scanner confirmation**: trivy rule `CVE-2024-4068` flagged this pattern. ## Changes - `hugo-blox/blox-tailwind/package.json` - `hugo-blox/blox-tailwind/pnpm-lock.yaml` ## Behavior Preservation This change touches only dependency manifests (`hugo-blox/blox-tailwind/package.json`, `hugo-blox/blox-tailwind/pnpm-lock.yaml`); no source file in the repository is modified. --- *This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.* --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)*  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-29 14:32:11 +00:00

bsakaguchi referenced this issue

2026-10-29 14:32:11 +00:00

[PR #41] [MERGED] Add dots3-note KV cache calculator support #42

bsakaguchi closed this issue

2026-10-29 14:32:11 +00:00