Repository navigation
chore(security): force minimatch 11.0.1+ in the JS client (Dependabot #249) - #502
Closed
MPCoreDeveloper wants to merge 1 commit into
Closed
MPCoreDeveloper wants to merge 1 commit into
MPCoreDeveloper wants to merge 1 commit into
Conversation
Dependabot alert #249 (GHSA-g3hv-75wg-m249, CVE-2026-118764): minimatch >= 7.0.0 and < 11.0.1 is vulnerable to a denial of service via globparts amplification. The client resolved two copies inside that range - 10.2.6 through eslint 10 / @typescript-eslint / glob 13, and 9.0.9 through ts-jest -> @jest/transform -> babel-plugin-istanbul -> test-exclude -> glob 10 - and the patched version is 11.0.1. Adds "minimatch": "^11.0.1" to the existing overrides block (the same mechanism already used for protobufjs and esbuild) and regenerates the lockfile with npm install --package-lock-only, which resolves 11.0.8 and removes the nested 9.0.9 plus its nested brace-expansion/balanced-match. Overrides apply to this project install only, so the published @sharpcoredb/client dependency graph is unchanged. Note the resolved 11.0.8 declares node 20 || >=22 for dev installs; the package engines field (>=16) is untouched. Verified: npm audit no longer lists minimatch; npm run typecheck, npm run build (CJS/ESM/DTS) and npm test (16/16) pass.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Dependabot alert #249 — GHSA-g3hv-75wg-m249 / CVE-2026-118764, minimatch has potential denial of service via globparts amplification (moderate).
What was wrong
minimatch>= 7.0.0, < 11.0.1is vulnerable, and the JS client resolved two copies inside that range:minimatch@10.2.6— viaeslint@10,@typescript-eslint/parserandglob@13minimatch@9.0.9— viats-jest→@jest/transform→babel-plugin-istanbul→test-exclude→glob@10There is no Dependabot PR for it (the alert is npm-only, in a dev-only dependency chain), so it needed a manual override.
The change
Adds
"minimatch": "^11.0.1"to theoverridesblock that already exists forprotobufjsandesbuild, and regenerates the lockfile withnpm install --package-lock-only. The override resolves 11.0.8 and removes the nested9.0.9together with its nestedbrace-expansion/balanced-match(2 files, +14/−38).overridesapply to this project's install only, so the published@sharpcoredb/clientdependency graph is unchanged. The resolved 11.0.8 declaresnode 20 || >=22for dev installs — the package's ownengines(>=16) is untouched, so consumers are unaffected.Verification
npm auditno longer listsminimatch(was: 1 moderate in the JS client).npm run typecheck— clean.npm run build(tsup, CJS + ESM + DTS) — succeeded.npm test— 16/16 passing (3 suites).Not fixed by this PR
deepmerge@4.3.1(Dependabot alert #246, low, viajest-config) has no patched release — 4.3.1 is the latest published version — so it cannot be fixed by a version bump. The options are to dismiss that alert with a documented reason (dev-only, prototype-poisoning, no fix available) or to replace the dependency; both are owner decisions, so the alert is left open deliberately.With #501 (Aspire 13.6.5) and this PR, 5 of the 6 open Dependabot alerts are addressed: the critical and three high-severity Aspire advisories by #501, and the moderate minimatch advisory here.