Repository navigation
fix(deps): close the minimatch glob pattern DoS (GHSA-g3hv-75wg-m249) - #424
Conversation
GHSA-g3hv-75wg-m249 covers every minimatch below 11.0.1. eslint 9 pulled 3.1.5 and typescript-estree pulled 10.2.6. Move eslint to 10, which imports minimatch by named export, and override minimatch to ^11.0.1 since no parent release asks for 11 yet.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Dependency updates package.json |
The ESLint development dependency range changes to ^10.14.0. The overrides add minimatch: ^11.0.1 and retain esbuild: ^0.28.1. The comment documents the minimatch pin. |
Estimated code review effort: 2 (Simple) | ~8 minutes
Change: Bug fix
Merge Risk: 
1f038
-
The dependency changes are mergeable with no identified user or workflow impact.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the main change: updating dependencies to address the minimatch glob pattern denial-of-service vulnerability. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Problem
Dependabot alert #76 (GHSA-g3hv-75wg-m249, medium) flags every minimatch below 11.0.1. A crafted glob pattern with repeated
**/../segments makes minimatch keep cloning pattern parts during preprocessing and then compare them pairwise, so one pattern can burn CPU and memory. Our lockfile had two copies, both dev-only: 3.1.5 from eslint 9 (and its@eslint/eslintrcand@eslint/config-array), and 10.2.6 from@typescript-eslint/typescript-estree.Fix
^10.2.6, typescript-estree 8.72.1 wants^10.2.2), sooverridesnow setsminimatchto^11.0.1. Everything dedupes to 11.0.3.@eslint/eslintrcdoimport minimatch from "minimatch", and minimatch 11 has no default export, so overriding under eslint 9 would break lint. eslint 10 and@eslint/config-array0.23 importMinimatchby name and work with 11. typescript-eslint 8.72 already allows eslint 10 as a peer.Verification
On a clean clone, with the npm 10 that ships with Node 22 as CI uses:
npm ls minimatch --allshows one copy, 11.0.3.npm ci --ignore-scripts, typecheck (src and tests), lint,test:coverage(145 files, 2623 tests), the Madrid-time wash-sale run (51 tests),npm run buildandnode dist/cli.js --versionall pass.anyaccess reported 3 errors.Summary by CodeRabbit