Repository navigation
fix(deps): override minimatch for typescript-estree to ^11.0.1 - #240
Merged
Merged
Conversation
GHSA-g3hv-75wg-m249 (moderate, ReDoS via globparts amplification) affects minimatch >=7.0.0 <11.0.1. The only affected copy is minimatch@10.2.5 under @typescript-eslint/typescript-estree, which pins ^10.2.2 even in its latest release. Dependabot's security update fails because no update path resolves a patched version. Scope the override to typescript-estree. It only uses the named minimatch export, which 11.x keeps. The minimatch@3.1.5 copies used by eslint are outside the advisory range and stay untouched. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ronny Trommer <ronny@no42.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failing Dependabot security update run https://github.com/no42-org/CoolModFiles/actions/runs/41845781370.
GHSA-g3hv-75wg-m249 (moderate) affects minimatch
>=7.0.0 <11.0.1. The only affected copy isminimatch@10.2.5under@typescript-eslint/typescript-estree. That package pins^10.2.2, even in its latest release (8.72.1). Dependabot cannot find an update path, so the job errors.This adds a scoped npm override
@typescript-eslint/typescript-estree > minimatch: ^11.0.1(resolves 11.0.5). typescript-estree only uses the namedminimatchexport, which 11.x keeps. Theminimatch@3.1.5copies used by eslint are outside the advisory range and are unchanged.Dev-only dependency. No runtime impact.
Verification:
npm audit: found 0 vulnerabilities (was 8 moderate)make verify: lint, typecheck, unit tests, audit and build passDrop the override once typescript-estree depends on minimatch 11.
🤖 Generated with Claude Code
https://claude.ai/code/session_0197CGJEYJkMGQVfxFvFmSup