[SebastianLopezO]

Caso

• Origen: Dependabot alerts, #131
  (GHSA-g3hv-75wg-m249, minimatch has potential denial of service via globparts amplification).
• Severidad: media; afecta a minimatch < 11.0.1.
• Análisis: minimatch 10.2.5 llega solo por ESLint 10 (@eslint/config-array y @typescript-eslint/typescript-estree),
  es dependencia de desarrollo y procesa los patrones de la configuración del propio repositorio. ESLint pide ^10,
  así que Dependabot no puede proponer la actualización.

Cambio

• overrides: minimatch: ^11.0.1 en pnpm-workspace.yaml (lockfile con minimatch 11.0.3), con la nota de quitarlo
  cuando ESLint dependa de la 11.

Verificación

• pnpm why minimatch → 11.0.3.
• pnpm lint (ESLint usa minimatch para los patrones de la configuración), pnpm test y pnpm build en verde;
  pnpm install --frozen-lockfile pasa.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@isaacs/nonrecursive-glob-match	1.0.3	Unknown	Unknown
npm/minimatch	11.0.3	🟢 5.5	Details Check Score Reason Code-Review ⚠️ 0 Found 1/28 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 4 2 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 4 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• pnpm-lock.yaml