[Anber]

Motivation

A dependency audit of pnpm-lock.yaml reports vulnerable packages. For some of them the fixed version lies inside the range their dependents already declare, so re-resolving the lockfile reaches it without editing any manifest. This pull request does that for 37 such instances.

One more problem sits in a manifest: @linaria/react declares "minimatch": "^9.0.3" in dependencies, and the lockfile resolved it to 9.0.3. minimatch 9.x below 9.0.7 is affected by regular expression denial of service advisories (GHSA-3ppc-4f35-3m26 below 9.0.6, GHSA-7r86-cg39-jmmj and GHSA-23c5-xmqv-rm74 below 9.0.7), so ^9.0.3 lets a consumer of @linaria/react stay on an affected version.

This is not a fix for every advisory in the lockfile. After the branch, the same audit still lists 31 vulnerable packages in 39 instances; the main leftovers and the reasons for them are under "Left out".

Summary

The branch has three commits, one item each, on top of the current master:

1. chore(deps): refresh vulnerable lockfile entries within their ranges changes only pnpm-lock.yaml.
2. fix(react): raise the minimatch floor to ^9.0.7 changes packages/react/package.json and the matching importer lines of pnpm-lock.yaml.
3. chore(react): add a changeset for the minimatch floor adds one changeset.

Three files differ from master: .changeset/raise-react-minimatch-floor.md, packages/react/package.json and pnpm-lock.yaml.

Lockfile refresh (commit 1)

• The 37 instances that the audit marks as fixable by a lockfile refresh are re-resolved with pnpm 9.15.9 within their existing ranges; the rest of the lockfile is not re-resolved. None of the 37 is left in the lockfile.
• No specifier, setting or override changes, and the lockfile header up to importers: is the same as on master. No package that was already in the lockfile gains a new major version line.
• Release-age rule: every version the refresh moves to was published at least a week before the work, because a fresh release is the usual way a compromised package spreads. Where the newest version in range was younger, the newest one that is old enough and still fixes the advisory was taken. The only exceptions are caniuse-lite and electron-to-chromium, which publish browser data almost daily and are taken at their latest versions. The newest of the other versions was published on 2026-10-09.
• The npm advisory database reports no advisory for any of the 49 name@version pairs the refresh moves to (new lockfile entries, new targets of dependency lines and changed importer versions).
• Examples of what moves: vite 6.4.3 to 6.4.4, rollup 3.29.5 to 3.30.0, launch-editor 2.14.1 to 2.14.2, eslint's minimatch 3.1.2 to 3.1.5, nanoid 3.3.6 and 3.3.16 to 3.3.20, source-map-js 1.0.2 and 1.2.1 to 1.2.2, and the seroval used by solid-js 1.5.5 to 1.6.9. Some refreshed packages need new transitive packages, such as node-releases for the refreshed browserslist.
• The snapshot entries of the three postcss versions in the lockfile do change, but only their dependency lines, which now point to the refreshed nanoid and source-map-js. No postcss instance changes version (8.4.31, 8.5.19 and 8.5.31 stay).
• Importer blocks: examples/vite changes only in resolved versions (vite 6.4.3 to 6.4.4 and the rollup peer suffix 3.29.5 to 3.30.0), with its specifiers unchanged. The importer blocks of examples/astro-solid and examples/vpssr-linaria-solid do not change. No manifest of any example changes.

minimatch floor (commit 2)

• packages/react/package.json: "minimatch": "^9.0.3" becomes "minimatch": "^9.0.7". It is the only manifest line of the whole branch that changes.
• pnpm-lock.yaml: the packages/react importer goes from specifier: ^9.0.3 / version: 9.0.3 to specifier: ^9.0.7 / version: 9.0.9. minimatch 9.0.9 was already in the lockfile, so no package is added, and no other importer specifier changes.
• ^9.0.7 excludes all three advisories above.
• minimatch 9.0.3 stays in the lockfile only because syncpack (dev tooling) pins it exactly. It is not reachable at runtime from a published package, and packages/react resolves 9.0.9.

Changeset (commit 3)

.changeset/raise-react-minimatch-floor.md marks @linaria/react as patch and says "Require minimatch ^9.0.7 so installs no longer resolve a minimatch version with known regular expression denial of service advisories." It names only the package whose manifest changes; @linaria/react is in the fixed group of the changeset config, and an existing changeset also names a single package of that kind.

Left out

These are separate changes and none is touched here:

• postcss: no postcss instance changes version in this pull request, including the 8.5.19 copy, for which the audit knows a fix inside its range. postcss is left to its own change.
• braces 3.0.3: no fixed release exists.
• postcss-selector-parser 6.0.10: the fix needs a new major version, reached through the stylelint chain.
• minimatch 9.0.3, kept for syncpack as described above.
• Instances held back by a parent package that this pull request does not update, such as webpack-dev-server, tsup and turbo.

Three instances that a published package can still reach at runtime remain after the branch: braces 3.0.3, postcss 8.4.31 and postcss-selector-parser 6.0.10.

Test plan

I ran these with pnpm 9.15.9 (the version in the root packageManager field):

pnpm install --frozen-lockfile --ignore-scripts
pnpm --filter ./packages/core build
pnpm --filter ./packages/react test
pnpm exec syncpack list-mismatches
pnpm exec commitlint --from <base commit of master> --to HEAD

• pnpm install --frozen-lockfile --ignore-scripts succeeds at each of the three commits, in a clean copy of each, and leaves pnpm-lock.yaml unchanged. At the head, pnpm install --lockfile-only --ignore-scripts also leaves the file byte-identical.
• pnpm --filter ./packages/react test after building @linaria/core: 2 suites, 22 tests and 17 snapshots pass.
• syncpack list-mismatches and commitlint over the three commits exit 0.
• The audit at the head lists 31 vulnerable packages in 39 instances, and none of the 37 instances this pull request targets.
• Scope: besides the @linaria/react minimatch line, no specifier changes (the importer specifiers are otherwise the same, with the same 22 workspace links), and none of webpack-dev-server, eslint, tsup, turbo, syncpack, stylelint, astro and typescript changes version.

Not verified

• I have not seen a CI result for this pull request.
• Beyond the commands above, this description claims nothing about the full build, the type checks, lint or the tests of the other packages.
• Installs ran with --ignore-scripts, so no lifecycle scripts of the refreshed packages were run.
• Another open change that rewrites the same postcss entries of pnpm-lock.yaml may conflict textually with this one; I did not test the branch merged with any other change.
• The audit counts are those of the advisory database on the day the audit ran; new advisories can change them.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1bfa3da

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@linaria/react	Patch
@linaria/atomic	Patch
@linaria/core	Patch
@linaria/babel-plugin-interop	Patch
linaria	Patch
@linaria/postcss-linaria	Patch
@linaria/server	Patch
@linaria/stylelint-config-standard-linaria	Patch
@linaria/stylelint	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR