Dashboard › spotlight › Distillation
0fa99b35-5640-47a1-a772-b87ba9a9cee2["dafa7a44f5fe0809412142c38e1043b2","8700cb4e46616068311cf68ce2a48d67","98ae3a7767bea6eba4d8aad95cceedab","9ab76a6856b17c651dd2be9e33a1eb72","4a64e877b8fa27286481426d3521ee82"]
Date: July 28, 2026
export const EXPANSION_MAX = 100_000 + export function expand(str, options = {}); 5.0.8 ESM identical plus comment about EXPANSION_MAX_LENGTH; 5.0.8 CJS sets Object.defineProperty(exports, "__esModule", { value: true }) with exports.expand, exports.EXPANSION_MAX, exports.EXPANSION_MAX_LENGTH — NO exports.default.'brace-expansion' does not provide an export named 'default' means importer does ESM default import; 5.0.8 ESM has only named exports, no export default.export function expand(str, options = {})) and 5.0.8 ESM tail (identical); confirmed neither version has export default.__esModule: true but no exports.default; Node CJS→ESM interop does NOT synthesize a default export when __esModule: true is present, so import brace from 'brace-expansion' yields undefined → "does not provide an export named 'default'". 5.0.7 (no __esModule) gets synthesized default = module.exports, builds fine. Importer is a CJS default-import consumer in the website config-load graph (candidate: vitefu or astro config import braceExpansion from 'brace-expansion').<=5.0.7 per advisory #323). @vercel/nft uses glob for build-time file tracing — not a runtime untrusted-input DoS surface for Spotlight users. Real risk is Spotlight's own 2.x glob/minimatch line. Proposed fix: change override floor from >=2.1.0 <3 (resolves to 2.1.0, vulnerable) to >=2.1.3 for the 2.x line; keep 5.x untouched (stays 5.0.7). Document #323 5.x portion as residual blocked by upstream ESM incompatibility (brace-expansion 5.0.8 drops CJS default export). Alternative considered: override @vercel/nft's glob@13→glob@10 (minimatch 9→brace 2.x) — rejected as risky (API changes).