NPM audit results

Develop, Build & Integrate
1

My root project’s npm audit currently reports 8 high-severity findings, all associated with this underlying advisory:

braces: stack-exhaustion denial of service through deeply nested patterns
https://github.com/advisories/GHSA-vfj7-8cjw-p6xm

The installed version is braces@3.0.3, pulled in through:

Chokidar 3.6.0, required by the CLI and its local development libraries.
Micromatch 4.0.8, required through findup-sync.
When checked, the npm registry reported 3.0.3 as the latest braces release, and the advisory listed no patched version. Had anyone faced this issue before and how did you fix it?

3

Thank you @CanerKaya for explaining this. I checked my project and found:

  • npm ls braces shows braces@3.0.3 coming through @hubspot/cli@8.16.0, via Chokidar and via Micromatch/Findup-sync.
  • The CLI is now in the root project’s devDependencies, and running npm audit --omit=dev at the root reports 0 vulnerabilities.
  • My card and serverless functions have separate packages; their audits also reported 0 vulnerabilities when checked earlier.
  • A targeted search of my JavaScript and TypeScript source under src, excluding node_modules, found no references to micromatch, braces, minimatch, fast-glob, glob(, or globSync. I understand this is not a complete security review.

I have not added a braces override or used npm audit fix --force. Eight high-severity findings remain in the root audit, tracing back to the braces advisory.

For transparency, I previously added six overrides scoped under the CLI for other findings: @modelcontextprotocol/sdk, axios, js-yaml, moment, qs, and @sentry/node. CLI version checks, sandbox upload/build/deployment, and product loading/submission tests passed, but I haven’t validated every CLI feature.

Given these results, is monitoring the advisory and waiting for a supported CLI update the appropriate interim approach? Are there additional checks you recommend for user-controlled patterns reaching these libraries indirectly? Also, should the six unrelated overrides be reviewed separately with HubSpot Support?

5

Thank you so much @CanerKaya for your valuable input on this issue. Appreciate it!