From 865c614ba5b0f9ed9960c2a98831e11f0fe87c81 Mon Sep 17 00:00:00 2001
From: "ugo.bechameil" <ugo.bechameil@hackolade.com>
Date: Tue, 28 Jul 2026 15:09:07 +0200
Subject: [PATCH] chore: address Trivy production dependency vulnerabilities

Bump vulnerable production dependencies/overrides and refresh package-lock.json to clear Plugins develop Trivy findings.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 package-lock.json | 22 +++++++++++-----------
 package.json      |  7 ++++---
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0c96520..36b3c22 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,14 +1,14 @@
 {
     "name": "Oracle",
-    "version": "0.2.61",
+    "version": "0.2.64",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "Oracle",
-            "version": "0.2.61",
+            "version": "0.2.64",
             "dependencies": {
-                "adm-zip": "0.5.9",
+                "adm-zip": "0.6.0",
                 "async": "3.2.6",
                 "lodash": "4.18.1",
                 "oracledb": "6.6.0",
@@ -1133,12 +1133,12 @@
             }
         },
         "node_modules/adm-zip": {
-            "version": "0.5.9",
-            "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.9.tgz",
-            "integrity": "sha512-s+3fXLkeeLjZ2kLjCBwQufpI5fuN+kIGBxu6530nVQZGVol0d7Y/M88/xw9HGGUcJjKf8LutN3VPRUBq6N7Ajg==",
+            "version": "0.6.0",
+            "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+            "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
             "license": "MIT",
             "engines": {
-                "node": ">=6.0"
+                "node": ">=14.0"
             }
         },
         "node_modules/aggregate-error": {
@@ -1254,16 +1254,16 @@
             }
         },
         "node_modules/brace-expansion": {
-            "version": "5.0.6",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-            "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+            "version": "5.0.8",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+            "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^4.0.2"
             },
             "engines": {
-                "node": "18 || 20 || >=22"
+                "node": "20 || >=22"
             }
         },
         "node_modules/braces": {
diff --git a/package.json b/package.json
index 245fee3..c52f447 100644
--- a/package.json
+++ b/package.json
@@ -64,7 +64,7 @@
     "description": "Hackolade plugin for Oracle and Autonomous databases",
     "disabled": false,
     "dependencies": {
-        "adm-zip": "0.5.9",
+        "adm-zip": "0.6.0",
         "async": "3.2.6",
         "lodash": "4.18.1",
         "oracledb": "6.6.0",
@@ -94,6 +94,7 @@
         "simple-git-hooks": "2.13.1"
     },
     "overrides": {
-        "minimatch": "10.2.4"
+        "minimatch": "10.2.4",
+        "brace-expansion": "5.0.8"
     }
-}
\ No newline at end of file
+}