[Copilot]

Motivation & Context

This resolves Dependabot alert GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) for python/packages/devui/frontend/yarn.lock. In brace-expansion 1.1.18, expanding {a},b}-shaped input takes quadratic time, so large inputs can block the event loop for seconds. The fix is in 1.1.21.

Description & Review Guide

• What are the major changes?
  • package.json: the existing npm override moves from "brace-expansion@1": "1.1.18" to "1.1.21", the lowest patched version.
  • package-lock.json: regenerated with npm install --package-lock-only.
  • yarn.lock: regenerated with yarn so brace-expansion@^1.1.7 resolves to 1.1.21. package.json gains no direct dependency. Yarn also rewrote the resolved URLs for balanced-match and concat-map; versions and integrity hashes are unchanged.
• What is the impact of these changes?
  • Reachability: not reachable, high confidence. brace-expansion 1.x only comes in through minimatch@3, which is used by eslint, @eslint/eslintrc and @eslint/config-array. All are devDependencies ("dev": true in the lockfile).
  • Nothing in src/ or in the agent_framework_devui Python package imports minimatch or brace-expansion, so it is not part of the shipped UI bundle. The only patterns it ever expands are the repo's own ESLint config and file globs.
  • This change mainly satisfies vulnerability scanners; it does not fix a real exposure.
• What do you want reviewers to focus on?
  • The advisory also lists 2.1.4 as affected. The brace-expansion@2 override still pins 2.1.4, which a dev-only dependency (@typescript-eslint/typescript-estree) uses. I left it alone because this alert only covers the 1.x version; decide whether to bump it here or separately.

Related Issue

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service</alert_title>
<alert_description>### Summary

Expanding {a},b}-shaped input takes time quadratic in the number of literal } characters, blocking the event loop.

Bash preserves a quirk where a brace group followed by a comma set still expands ({a},b}). The parser implements this by rewriting the string and restarting the scan. Each pass absorbs exactly one } and re-scans from the beginning, so n trailing braces cost n full passes.

Reproduction

const build = n => '{a}' + '}'.repeat(n) + ',z}'

for (const n of [8000, 16000, 32000, 64000, 128000]) {
  const t = Date.now()
  expand(build(n))
  console.log(n, Date.now() - t + 'ms')
}

n	input	time	results
8,000	8 KB	110 ms	2
16,000	16 KB	446 ms	2
32,000	32 KB	1.7 s	2
64,000	64 KB	6.9 s	2
128,000	128 KB	27.7 s	2

ms/n^2 is flat at ~1.7 and each doubling of n costs exactly 4.0x - quadratic. 128 KB of input blocks the event loop for nearly half a minute to produce two results.

Mechanism

Instrumenting the rewrite branch confirms it runs exactly n + 1 times, once per literal }, each re-scanning the whole string.

There is a second multiplier. The rewrite replaces the group's closing } with the internal escClose sentinel, which is '\0CLOSE' + Math.random() + '\0' - about 25 characters. The working string therefore grows by ~25 characters on every pass:

n	input length	final string length
1,000	1,006	26,006
8,000	8,006	208,006

So the input is inflated roughly 26x, and that factor multiplies both the quadratic constant and peak memory. This makes it partly a memory-pressure issue as well as a CPU one.

Why max and maxLength do not help

The cost is in parsing, before the result set exists. The payload yields 2 results regardless of size, so neither bound is ever reached.

Impact

An application passing an untrusted pattern to expand(), directly or through minimatch / glob, can have its event loop blocked for tens of seconds by a payload well under minimatch's 65,536-character cap. For a single-threaded Node server that is a full stall, not just a slow request.

Degraded availability rather than a crash - the process recovers once the expansion completes.

Affected versions

Verified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, all within a few percent of each other (~460-490 ms at n=16,000).

Patch

The rewrite loop gets an iteration bound. Past the cap the remaining string is treated as non-expanding and returned literally, consistent with the existing max / maxLength caps, which truncate rather than throw.

Note this bounds the number of passes, not the cost of each: worst-case work remains proportional to cap x input length. The cap is set low enough that the residual is bounded in practice, and far above what any realistic {a},b} input needs.

Severity note

Scored 5.3 Medium (A:L) for consistency with GHSA-3jxr-9vmj-r5cp, the other algorithmic-complexity advisory on this package (CWE-407), which uses the same vector. The stack-exhaustion advisories on this package score A:H because they crash the process outright; this one stalls it.</alert_description>

moderate
GHSA-q2hr-2g5m-vwhr, CVE-2026-102277
brace-expansion
npm
<vulnerable_versions>1.1.18</vulnerable_versions>
<patched_version>1.1.21</patched_version>
<manifest_path>python/packages/devui/frontend/yarn.lock</manifest_path>

https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr https://nvd.nist.gov/vuln/detail/CVE-2026-102277 https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96 https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22 https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364 https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e https://github.com/advisories/GHSA-q2hr-2g5m-vwhr

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites us...

• Resolves microsoft/agent-framework alert revert update #258

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit 5828489 in the copilot/fix-brace-ex... branch is 92%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	copilot/fix-brace-ex... 5828489	+/-
packages/core/a...ework/_tools.py	—	96%	—
packages/core/a...ework/_types.py	—	95%	—
packages/core/a...work/_skills.py	—	95%	—
packages/openai..._chat_client.py	—	94%	—
packages/core/a.../_compaction.py	—	94%	—
packages/core/a...ork/_vectors.py	—	93%	—
packages/core/a...bservability.py	—	93%	—
packages/core/a...amework/_mcp.py	—	92%	—
packages/ag-ui/...i/_agent_run.py	—	90%	—
packages/core/a...ork/security.py	—	89%	—