UI Extensions toolchain installs brace-expansion@2.1.2 affected by GHSA-mh99-v99m-4gvg

Extensions
1

The current Customer Account UI Extension dependency chain installs
brace-expansion@2.1.2 through:

@shopify/ui-extensions
→ ts-morph
→ @ts-morph/common
→ minimatch@9.0.9
→ brace-expansion@2.1.2

Environment and versions:

  • Node.js 24.13.1
  • npm 11.8.0
  • @shopify/ui-extensions 2026.4.0
  • ts-morph 25.0.1
  • @ts-morph/common 0.26.1
  • minimatch 9.0.9
  • brace-expansion 2.1.2

npm audit reports GHSA-mh99-v99m-4gvg as high severity. In our tested app, a
clean production Shopify app build did not include ts-morph, minimatch, or
brace-expansion in the generated UI extension bundles, source-map inputs, or
metafile inputs. They remain installed in the package dependency graph, but we
found no evidence that they are included in the deployable UI runtime
artifacts.

Reproduction:

  1. Run npm ci from a clean checkout.
  2. Run npm explain minimatch --json.
  3. Run npm explain brace-expansion --json.
  4. Run npm audit --json.
  5. Run
    npm exec --offline -- shopify app build --config production --no-color --skip-dependencies-installation.

We inspected the generated UI bundles, source maps, metafile input lists, and
external imports. None references minimatch, brace-expansion, ts-morph, or
@ts-morph/common.

Could the supported UI Extensions dependency chain be updated to versions of
ts-morph / @ts-morph/common that use a non-affected minimatch and
brace-expansion version?

We do not want to force an incompatible minimatch major through an application
override, because @ts-morph/common 0.26.1 declares minimatch ^9.0.4 and npm
reports an override to minimatch 10 as an invalid dependency tree.

The smallest preferred fix is a compatible @shopify/ui-extensions dependency
update whose ts-morph/@ts-morph/common chain permits a patched minimatch and
brace-expansion release.

2

Hey @morixi4106 - thanks for flagging.

The vulnerability and its patched versions are being handled upstream, with updated brace-expansion 2.x releases now available. Questions about the advisory ranges are best directed to the package maintainers.

But, that said, your separate question about why this toolchain dependency is included in the published @shopify/ui-extensions dependency graph is something I can look into on our end. I’ll dig into whether that’s expected and loop back once I have more context to share.