Repository navigation
fix(deps): patch transitive minimatch, re2js, katex, smol-toml and zod - #28
Conversation
…and zod The same vulnerable transitive versions as 0-draft/aws-credentials: eslint and typescript-eslint still require minimatch ^10, markdownlint-cli2 0.24.0 pins markdownlint 0.42.0 (re2js 2.8.6, katex 0.16) and smol-toml 1.8.0. Override them to patched releases and move zod to 4.6.7 within range.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| "smol-toml": "1.9.0", | ||
| "katex": "0.18.10", | ||
| "minimatch": "11.0.5", |
There was a problem hiding this comment.
These exact-version overrides force versions outside the ranges the dependents declare. minimatch 11.0.5 is forced onto eslint and typescript-eslint, which ask for ^10.2.x. katex 0.18.10 is forced onto micromark-extension-math, which asks for ^0.16.0. The katex bump also pulls commander 8 → 15, which needs Node >=22.12. CI uses Node 24, so it passes, but a lint run on an older Node would fail on install or run. All of these are dev-only, but green CI only shows that lint still runs, not that those consumers work with a new major or a 0.x minor bump. Two things to check:
- If the aim is only to clear advisories, say which advisory each pin fixes. A patched 10.x
minimatchand 0.16.xkatexmay exist and would keep the declared ranges. - Exact pins in
overrideswill not pick up later patch releases. They also need manual removal once upstream ranges catch up. Consider ranges (^), or a comment recording why each pin exists.
There was a problem hiding this comment.
Per pin: minimatch 11.0.5 for GHSA-g3hv-75wg-m249 (>=7.0.0 <11.0.1, no patched 10.x exists, latest 10.x is the vulnerable 10.2.6). katex 0.18.10 for GHSA-238p-pmpm-9mq7 (>=0.11.0 <0.18.2, no patched 0.16.x). re2js 2.9.1 for GHSA-gg6h-894w-4m9c (<2.8.7). smol-toml 1.9.0 for GHSA-r4xh-jqrq-34v2 (<=1.8.0). These are the same pins 0-draft/aws-credentials uses. Node: CI and the deploy workflow both run Node 24, and the repository is being retired (archive on or after 2026-12-08), so the exact pins will not need maintaining past that.
|
Dependency-only change (package.json overrides and lockfile). No source, docs, EN/JA content or workflow changes. Nothing to flag on parity, injection or documentation claims. One finding, posted inline on package.json:20-22. The exact-version overrides force minimatch 11 (dependents ask for ^10), katex 0.18 (dependents ask for ^0.16) and, through katex, commander 15 (Node >=22.12). These are dev-only and CI runs Node 24, so it works today. The pins are exact, so later patch releases will not be picked up, and the advisory each one addresses is not stated. |
The repository stays public until it is archived (on or after 2026-12-08), so this clears the vulnerable transitive dev dependencies
npm auditreports, matching the fix in 0-draft/aws-credentials#18. No Dependabot alerts were open here, but the lockfile had the same versions.minimatch11.0.5 (GHSA-g3hv-75wg-m249; eslint/typescript-eslint still require ^10),re2js2.9.1 andkatex0.18.10 (both under markdownlint 0.42.0, pinned by markdownlint-cli2 0.24.0),smol-toml1.9.0.npm audit fix: zod 4.6.5 → 4.6.7 (GHSA-mrhx-c7xc-m3w5) within the existing range.Verification: typecheck, lint, format:check, lint:md, test and build all pass locally;
npm auditreports 0 vulnerabilities.