Repository navigation
tools/ide: npm audit clean (minimatch 11 by an override) - #426
Merged
Merged
Conversation
All 10 moderate findings were minimatch 7.0.0 - 11.0.0 (GHSA-g3hv-75wg-m249, DoS via globparts amplification), through eslint, typescript-eslint, @vscode/vsce and vscode-languageclient; no 10.x release is fixed. npm audit fix --force would have taken eslint back to 9. Instead: "overrides": { "minimatch": "^11.0.1" } (11.0.4: the same CommonJS and ESM exports, Node 20+). The lock file regenerated (the override did not reach the workspace packages' dependencies with the old one); the bundles rebuilt. npm audit: 0 vulnerabilities. npm run build, npm test (30), npm run lint and vsce package pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All 10 moderate findings in
tools/idecame from one package:minimatch7.0.0–11.0.0 (GHSA-g3hv-75wg-m249, a denial of service through globparts amplification). It came in through eslint, typescript-eslint,@vscode/vsceandvscode-languageclient. No 10.x release has the fix.npm audit fix --forcewould have downgraded ESLint 10 to 9, a breaking change. Instead:"overrides": { "minimatch": "^11.0.1" }intools/ide/package.json, next to the existing@azure/msal-nodeoverride. That resolves to 11.0.4, which has the same CommonJS and ESM exports; its only stated difference is that it needs Node 20 or newer.dist/bundles are rebuilt.Checked:
npm auditreports 0 vulnerabilities.npm run build,npm test(30/30),npm run lintandvsce packageall pass.🤖 Generated with Claude Code