@shadcn/registry Depends on vulnerable versions of fast-glob

[realtebo]

braces  *
Severity: high
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
fix available via `npm audit fix --force`
Will install shadcn@1.0.0, which is a breaking change
node_modules/braces
  micromatch  >=0.2.0
  Depends on vulnerable versions of braces
  node_modules/micromatch
    fast-glob  *
    Depends on vulnerable versions of micromatch
    node_modules/@shadcn/registry/node_modules/fast-glob
    node_modules/@ts-morph/common/node_modules/fast-glob
    node_modules/shadcn/node_modules/fast-glob
      @shadcn/registry  <=0.0.0-rc-20261007105214 || >=0.1.0
      Depends on vulnerable versions of fast-glob
      node_modules/@shadcn/registry
        shadcn  <=0.0.0-rc-20261007105214 || >=2.0.0
        Depends on vulnerable versions of @shadcn/registry
        Depends on vulnerable versions of fast-glob
        Depends on vulnerable versions of ts-morph
        node_modules/shadcn
      @ts-morph/common  0.2.0 - 0.24.0 || 0.26.0 - 0.27.0
      Depends on vulnerable versions of fast-glob
      node_modules/@ts-morph/common
        ts-morph  6.0.1 - 23.0.0 || 25.0.0 - 26.0.0
        Depends on vulnerable versions of @ts-morph/common

Is there anywthing we can do to avoid this warning in our ci/cd?

We are using

dependencies

"shadcn": "^4.22.1"
"radix-ui": "^1.8.1",
 "cn": "^0.5.0",
"lucide-react": "^1.61.0",
"tailwind-merge": "^3.7.0",

devDependencies

"@tailwindcss/postcss": "^4.3.3",
 "tailwindcss": "^4.3.3",

[sophus-ingi]

There’s no fixed version of braces yet. The advisory covers everything up to 3.0.3, which is the latest release, so overrides or
npm audit fix can’t clear it. The upstream issue is micromatch/braces#70.

shadcn is only the CLI for adding components and doesn’t end up in your app bundle, so the practical fix for CI is to move it to devDependencies (or drop it and use npx shadcn@latest add ... when needed), then run:

npm audit --omit=dev

Don’t run npm audit fix --force. It “fixes” it by downgrading you to shadcn@1.0.0.

[zuhairhalawa]

GHSA-vfj7-8cjw-p6xm (the braces stack-exhaustion advisory) was withdrawn on 2026-10-23 as "not a practically exploitable vulnerability", so "no fixed version exists" no longer applies: there is nothing to patch or override, and nothing to change in shadcn.

npm's audit data no longer returns an advisory for braces 3.0.3, so re-running the audit on the same tree is enough. A lockfile resolved from shadcn@latest (4.22.1, which pulls braces 3.0.3 via micromatch 4.0.8 and fast-glob 3.3.3) reports "found 0 vulnerabilities" with npm 11.13.

If CI still fails on it, the result is probably cached, or comes from a scanner that mirrors the GitHub advisory database and hasn't re-synced since the withdrawal.

[zuhairhalawa]

If re-running the audit now comes back clean on your side, could you mark this as the answer? That way others who get the same CI warning can find it quickly.