Skip to content

fix(deps): patch transitive minimatch, re2js and zod #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kanywst merged 2 commits into from
Nov 8, 2026
Merged

fix(deps): patch transitive minimatch, re2js and zod #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b8bf7e7
fix(deps): override minimatch and re2js to patched versions
kanywst Nov 8, 2026
99810b7
fix(deps): bump zod to 4.6.7 in the lockfile (GHSA-mrhx-c7xc-m3w5)
kanywst Nov 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 20 additions & 12 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 3 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,8 @@
},
"overrides": {
"smol-toml": "1.9.0",
"katex": "0.18.10"
"katex": "0.18.10",
"minimatch": "11.0.5",

@claude claude Bot Nov 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This override forces minimatch 11 (a new major) onto every consumer, including eslint (^10.2.5), @eslint/config-array (^10.2.4) and @typescript-eslint/typescript-estree (^10.2.2). The lockfile still records those ^10 ranges, so the install is outside what each package declares it supports. It also pulls in a new transitive dependency, @isaacs/nonrecursive-glob-match. CI covers lint and build, but it won't show a glob-semantics change that only affects some ignore patterns. The commit message cites no advisory for minimatch, so please link the advisory and the first patched version. If a patched 10.x exists, pin that instead of jumping a major.

@kanywst kanywst Nov 8, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no patched 10.x: GHSA-g3hv-75wg-m249 covers minimatch >=7.0.0 <11.0.1, the first patched version is 11.0.1, and the latest 10.x is the vulnerable 10.2.6. eslint, @eslint/config-array and typescript-estree have no release on ^11 yet, so the override is the only way to clear it. The PR body names the advisory and patched version. Glob semantics: eslint's own ignore/config matching and markdownlint-cli2's globs run in CI (lint and lint:md over the whole repo) and produce the same results as on main. The override is dev-only and should be dropped once eslint and typescript-eslint move to ^11.

"re2js": "2.9.1"
}
}
Loading