Repository navigation
fix(deps): patch transitive minimatch, re2js and zod - #18
Conversation
minimatch <11.0.1 (GHSA-g3hv-75wg-m249) comes in through eslint and typescript-eslint, whose latest releases still ask for ^10; re2js <2.8.7 comes in through markdownlint 0.42.0, which markdownlint-cli2 0.24.0 pins exactly. Neither parent has a fixed release, so pin the patched versions with overrides.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| "smol-toml": "1.9.0", | ||
| "katex": "0.18.10" | ||
| "katex": "0.18.10", | ||
| "minimatch": "11.0.5", |
There was a problem hiding this comment.
This override forces minimatch 11 (a new major) onto every consumer, including eslint (^10.2.5), @eslint/config-array (^10.2.4) and @typescript-eslint/typescript-estree (^10.2.2). The lockfile still records those ^10 ranges, so the install is outside what each package declares it supports. It also pulls in a new transitive dependency, @isaacs/nonrecursive-glob-match. CI covers lint and build, but it won't show a glob-semantics change that only affects some ignore patterns. The commit message cites no advisory for minimatch, so please link the advisory and the first patched version. If a patched 10.x exists, pin that instead of jumping a major.
There was a problem hiding this comment.
There is no patched 10.x: GHSA-g3hv-75wg-m249 covers minimatch >=7.0.0 <11.0.1, the first patched version is 11.0.1, and the latest 10.x is the vulnerable 10.2.6. eslint, @eslint/config-array and typescript-estree have no release on ^11 yet, so the override is the only way to clear it. The PR body names the advisory and patched version. Glob semantics: eslint's own ignore/config matching and markdownlint-cli2's globs run in CI (lint and lint:md over the whole repo) and produce the same results as on main. The override is dev-only and should be dropped once eslint and typescript-eslint move to ^11.
|
Dependency-only change (package.json overrides and lockfile): zod 4.6.7, minimatch 11.0.5, re2js 2.9.1. No docs, EN/JA content or workflows are touched. One finding, posted inline on I could not check against the npm registry that minimatch 11.0.5 and re2js 2.9.1 exist or which advisories they fix. The Node engines they require (20+ and 22+) are compatible with the repo's Node >=24 requirement. |
Clears the two open Dependabot alerts, which Dependabot's security updates could not fix because no parent release takes the patched versions yet.
npm auditalso flagged zod 4.6.5 under eslint-plugin-react-hooks;npm audit fixmoves the lockfile to 4.6.7 within the existing range.The overrides can be dropped once eslint/typescript-eslint and markdownlint-cli2 ship releases on the patched versions.
Verification:
npm ci && npm run checkpasses (typecheck, ESLint on minimatch 11, Prettier, markdownlint on re2js 2.9.1, 284 tests, build);npm auditreports 0 vulnerabilities.