Skip to content

Commit dbfae4f

Browse files
cYKatherineclaude
andcommitted
UID2-6675: upgrade minimatch to fix CVE-2026-27903 ReDoS
Bumps minimatch overrides to patched versions: - minimatch (root): ^10.2.1 -> ^10.2.3 - eslint-plugin-import/minimatch: 3.1.2 -> 3.1.3 - glob/minimatch: ^10.2.1 -> ^10.2.3 CVE-2026-27903 / GHSA-7r86-cg39-jmmj: ReDoS via multiple GLOBSTAR segments in matchOne(), affects minimatch <3.1.3 and <10.2.3. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 75af6d6 commit dbfae4f

File tree

2 files changed

+284
-21
lines changed

2 files changed

+284
-21
lines changed

package-lock.json

Lines changed: 281 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,12 +247,12 @@
247247
"form-data": "^4.0.4",
248248
"glob": {
249249
".": "^11.1.0",
250-
"minimatch": "^10.2.1"
250+
"minimatch": "^10.2.3"
251251
},
252252
"jws": "^4.0.1",
253-
"minimatch": "^10.2.1",
253+
"minimatch": "^10.2.3",
254254
"eslint-plugin-import": {
255-
"minimatch": "3.1.2"
255+
"minimatch": "3.1.3"
256256
},
257257
"qs": "6.14.1",
258258
"@isaacs/brace-expansion": "^5.0.1",

0 commit comments

Comments
 (0)