Skip to content

fix(deps): patch minimatch and glob advisories - #270

Open
soloturn wants to merge 1 commit into
masterfrom
fix/minimatch-dos
Open

soloturn wants to merge 1 commit into
masterfrom
fix/minimatch-dos

Conversation

@soloturn

Copy link
Copy Markdown
Contributor

AI-assisted change proposal. Filed by agent driven by @soloturn via GDD.

Summary

  • Patches the minimatch DoS (GHSA-g3hv-75wg-m249, Dependabot #399) and the glob AbortSignal advisory (GHSA-3g3m-2fjr-6pw4); npm audit goes to 0.
  • Bumps eslint to ^10.15.0, which already uses minimatch 11.
  • Overrides minimatch to ^11 under @typescript-eslint/typescript-estree (latest still pins ^10), and glob ^14 plus minimatch ^11 under remark-cli.
  • Dependabot couldn't open this itself: its only route was downgrading typescript-eslint.
  • No blanket override: eslint@8 under the SARIF formatter needs minimatch 3, which is unaffected.
  • Drop the overrides once typescript-estree and remark-cli accept minimatch 11 on their own.

Test plan

  • npm audit reports 0 vulnerabilities
  • npm run lint:js passes
  • npm run lint:md runs
  • CI build

Related

  • Dependabot alert #399

…g3m-2fjr-6pw4)

eslint 10.15 and config-array already use minimatch 11. typescript-estree (latest) still pins ^10 and remark-cli's tree pins glob 10 / minimatch 9, so override those two subtrees only; eslint 8 under the SARIF formatter needs minimatch 3 and is left alone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Nov 14, 2026

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 2421c377-61e5-46f8-8a73-0696deec29b3
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant