From d52a7137c11ea6bf195fc1849c15395b0cf910a7 Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Mon, 2 Nov 2026 10:06:09 +0000 Subject: [PATCH] chore(deps): override minimatch to 11.0.1 and glob to 14.0.2 GHSA-g3hv-75wg-m249 (minimatch <11.0.1) and GHSA-3g3m-2fjr-6pw4 (glob >=9.0.0 <=14.0.1) are both moderate, so the CI audit fails on every branch. Both reach us only through dev tools: minimatch through eslint and mocha, glob through mocha. The patched versions are new majors, so they are pinned by override; lint, the unit suite and the build all pass on them. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- pnpm-lock.yaml | 49 ++++++++++++++++++++++++------------------------- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/package.json b/package.json index 46c5d16..ebb1a62 100644 --- a/package.json +++ b/package.json @@ -96,7 +96,8 @@ "minimatch@<3.1.4": "3.1.4", "minimatch@>=5.0.0 <5.1.8": "5.1.8", "minimatch@>=9.0.0 <9.0.7": "9.0.7", - "minimatch@>=10.0.0 <10.2.3": "10.2.3", + "minimatch@>=10.0.0 <11.0.1": "11.0.1", + "glob@>=9.0.0 <14.0.2": "14.0.2", "picomatch@<2.3.2": "2.3.2", "picomatch@>=4.0.0 <4.0.4": "4.0.4", "serialize-javascript": ">=7.0.5", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 566130e..1b8ec3e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -17,7 +17,8 @@ overrides: minimatch@<3.1.4: 3.1.4 minimatch@>=5.0.0 <5.1.8: 5.1.8 minimatch@>=9.0.0 <9.0.7: 9.0.7 - minimatch@>=10.0.0 <10.2.3: 10.2.3 + minimatch@>=10.0.0 <11.0.1: 11.0.1 + glob@>=9.0.0 <14.0.2: 14.0.2 picomatch@<2.3.2: 2.3.2 picomatch@>=4.0.0 <4.0.4: 4.0.4 serialize-javascript: '>=7.0.5' @@ -377,6 +378,9 @@ packages: resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} engines: {node: '>=18.0.0'} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@keyv/bigmap@1.3.1': resolution: {integrity: sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==} engines: {node: '>= 18'} @@ -969,8 +973,8 @@ packages: resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==} engines: {node: '>=10.13.0'} - glob@13.0.6: - resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} + glob@14.0.2: + resolution: {integrity: sha512-vfMgTR2djMHPUchsJMLpZlYQvtjVL+mHpEr5wPpoCbQs2vr/FBNK+3Gnl9Ara1DSs4Aeg4eG9HiADb5/rkY/ZA==} engines: {node: 18 || 20 || >=22} globals@17.13.0: @@ -1264,12 +1268,8 @@ packages: resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==} engines: {node: '>=18'} - minimatch@10.2.3: - resolution: {integrity: sha512-Rwi3pnapEqirPSbWbrZaa6N3nmqq4Xer/2XooiOKyV3q12ML06f7MOuc5DVH8ONZIFhwIYQ3yzPH4nt7iWHaTg==} - engines: {node: 18 || 20 || >=22} - - minimatch@10.2.6: - resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} + minimatch@11.0.1: + resolution: {integrity: sha512-t+Vn6DX4wPCxS23y03C0uhF7S1jpi1GfqPrnlEipCJaA2ykiNbMkVlDutZtmvLfRcUN6R8AYVlzTsQrT4RZoLQ==} engines: {node: 18 || 20 || >=22} minimist@1.2.8: @@ -1366,8 +1366,8 @@ packages: path-parse@1.0.7: resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==} - path-scurry@2.0.2: - resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} engines: {node: 18 || 20 || >=22} path-to-regexp@8.4.2: @@ -1830,7 +1830,7 @@ snapshots: dependencies: '@eslint/object-schema': 3.0.5 debug: 4.4.3(supports-color@8.1.1) - minimatch: 10.2.6 + minimatch: 11.0.1 transitivePeerDependencies: - supports-color @@ -1882,6 +1882,8 @@ snapshots: dependencies: minipass: 7.1.3 + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@keyv/bigmap@1.3.1(keyv@5.6.0)': dependencies: hashery: 1.5.1 @@ -2054,7 +2056,7 @@ snapshots: '@typescript-eslint/types': 8.72.0 '@typescript-eslint/visitor-keys': 8.72.0 debug: 4.4.3(supports-color@8.1.1) - minimatch: 10.2.3 + minimatch: 11.0.1 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@6.0.3) @@ -2396,7 +2398,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 - minimatch: 10.2.6 + minimatch: 11.0.1 natural-compare: 1.4.0 optionator: 0.9.4 transitivePeerDependencies: @@ -2586,11 +2588,11 @@ snapshots: dependencies: is-glob: 4.0.3 - glob@13.0.6: + glob@14.0.2: dependencies: - minimatch: 10.2.3 + minimatch: 11.0.1 minipass: 7.1.3 - path-scurry: 2.0.2 + path-scurry: 3.0.0 globals@17.13.0: {} @@ -2892,12 +2894,9 @@ snapshots: dependencies: mime-db: 1.54.0 - minimatch@10.2.3: - dependencies: - brace-expansion: 5.0.12 - - minimatch@10.2.6: + minimatch@11.0.1: dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -2915,11 +2914,11 @@ snapshots: debug: 4.4.3(supports-color@8.1.1) diff: 8.0.3 find-up-simple: 1.0.1 - glob: 13.0.6 + glob: 14.0.2 is-path-inside: 4.0.0 is-unicode-supported: 0.1.0 js-yaml: 5.5.0 - minimatch: 10.2.3 + minimatch: 11.0.1 ms: 2.1.3 picocolors: 1.1.1 serialize-javascript: 7.1.2 @@ -2990,7 +2989,7 @@ snapshots: path-parse@1.0.7: {} - path-scurry@2.0.2: + path-scurry@3.0.0: dependencies: lru-cache: 11.5.3 minipass: 7.1.3