Two new GHSA advisories surfaced in pnpm audit:
- brace-expansion >=5.0.0 <5.0.6 — DoS via large numeric range
(GHSA-jxxr-4gwj-5jf2). The existing override floor was 5.0.5;
bump to 5.0.6.
- ws >=8.0.0 <8.20.1 — uninitialized memory disclosure
(GHSA-58qx-3vcg-4xpx). Reached via @nx/angular >
@nx/module-federation > @module-federation/enhanced >
@module-federation/dts-plugin > ws@8.18.0. Pinning the override
to the 8.x range only — lighthouse's transitive ws@7.5.10 sits
outside the advisory.
Both fixes are pure pnpm.overrides bumps; remove them once Nx's
upstream chain catches up.
Julien Gautier