fix: braces: fails to limit the number of characters it can handle

[galanko]

Summary

Automated remediation for CVE-2024-4068: braces fails to limit the number of characters it can handle

Changes

Vulnerability Details

• CVE: CVE-2024-4068
• Severity: HIGH (CVSS 7.5)
• Issue: Memory exhaustion via imbalanced braces input
• Affected Version: braces < 3.0.3

Root Cause

The vulnerable version braces@2.3.2 was introduced transitively through:

• nodemon@3.0.1 → chokidar@2.1.8 → micromatch@3.1.10 → braces@2.3.2
• forever@4.0.3 → forever-monitor@3.0.3 → chokidar@2.1.8 → braces@2.3.2

Fix Applied

1. Updated nodemon from ^3.0.1 to ^3.1.0

   • Brings in chokidar@3.6.0 which depends on braces@3.0.3+

2. Added npm override for braces to >=3.0.3

   • Forces braces@3.0.3+ across ALL dependencies in the tree
   • Overrides instances that would otherwise pull braces@2.3.2 or @1.8.5

Verification

✅ All braces@2.3.2 instances replaced with braces@3.0.3
✅ No braces@2.3.2 in dependency tree
✅ Unit tests pass
✅ No breaking changes to application functionality
✅ Normal braces parsing works correctly

Files Modified

• package.json: Updated nodemon version, added braces override
• package-lock.json: Regenerated with updated dependencies

---

Generated by OpenSec remediation agent