Update minimatch to resolve security vulnerability #206

Activity

1. tats-u commented on Jun 22, 2025

   

   tats-u

   on Jun 22, 2025

   More actions

   serve-handler using minimatch 3.1.2, which is too old.
   The latest version of minimatch is 10.0.3!
2. RoiEf commented on Feb 19, 2026

   

   RoiEf

   on Feb 19, 2026

   Last edited by RoiEf

   More actions

   when is this expected?
   at the moment there is a high severity CVE on all minimatch < 10.2.1
   GHSA-3ppc-4f35-3m26
3. dargmuesli commented on Feb 19, 2026

   

   dargmuesli

   on Feb 19, 2026

   Last edited by dargmuesli

   Contributor

   More actions

   PR submitted: #226

   👍React with 👍3Reacted by Mike McCready, Masaya Suzuki and Juan Cabrera
4. MikeMcC399

   marked this as blocking on Feb 20, 2026

   • non-devDependencies vulnerabilities (ajv & minimatch) cypress-io/cypress-example-kitchensink#1025
5. dgw commented on Feb 25, 2026

   

   dgw

   on Feb 25, 2026

   More actions

   According to the linked advisory, 3.1.5 also patches the reported vulnerability. Minimatch has a lot of actively maintained legacy branches, in case upgrading all the way from 3.x to 10.x is too much.
6. tats-u commented on Feb 25, 2026

   

   tats-u

   on Feb 25, 2026

   Last edited by tats-u

   More actions

   If you want to neglect maintenance, completely fixing your dependencies is a terrible idea. It's better to switch to the ^ notation to push the responsibility for guaranteeing compatibility within the same major version onto the authors of the dependencies and the users of this package.

   Minimatch has a lot of actively maintained legacy branches, in case upgrading all the way from 3.x to 10.x is too much.

   We shouldn't rely on the goodwill of the author(s) of minimatch.

   👍React with 👍2Reacted by Alex McLean and Jonas Thelemann
7. ParakhJaggi

   added a commit that references this issue on Mar 2, 2026

   fix: update minimatch to 3.1.5 to resolve security vulnerabilities

   ...

   This issue will close once commit fcbfea8 is merged into the 'main' branch.

   fcbfea8
8. AndyBitz

   closed this as completedin #226on Mar 3, 2026
9. AndyBitz

   added 2 commits that reference this issue on Mar 3, 2026

   fix: update minimatch to 3.1.5 to resolve security vulnerabilities (#228

   ...

   This issue will close once commit af11c99 is merged into the 'main' branch.

   af11c99

   fix: update minimatch to 3.1.5 to resolve security vulnerabilities (#228

   ...

   This issue will close once commit 754d1dc is merged into the 'main' branch.

   754d1dc