Skip to content

Commit 438ab10

Browse files
authored
fix(deps): resolve minimatch ReDoS vulnerability (#482)
## Summary - Add yarn `resolutions` to force `minimatch >=9.0.7`, resolving both Dependabot alerts: - [#42](https://github.com/netresearch/node-magento-eqp/security/dependabot/42) — minimatch `^10.2.1` via eslint (patched in 10.2.3) - [#43](https://github.com/netresearch/node-magento-eqp/security/dependabot/43) — minimatch `^9.0.5` via typedoc (patched in 9.0.7) - Resolved to `minimatch@10.2.4` (covers both ranges) ## Test plan - [x] `yarn test` — 75 tests pass - [x] `yarn lint` — clean - [x] `yarn build:lib` — builds clean
2 parents 81ddfe2 + 71dfa82 commit 438ab10

File tree

2 files changed

+7
-23
lines changed

2 files changed

+7
-23
lines changed

package.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,5 +44,8 @@
4444
},
4545
"engines": {
4646
"node": ">=20"
47+
},
48+
"resolutions": {
49+
"minimatch": ">=9.0.7"
4750
}
4851
}

yarn.lock

Lines changed: 4 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -705,23 +705,11 @@ ast-v8-to-istanbul@^0.3.10:
705705
estree-walker "^3.0.3"
706706
js-tokens "^10.0.0"
707707

708-
balanced-match@^1.0.0:
709-
version "1.0.2"
710-
resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee"
711-
integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==
712-
713708
balanced-match@^4.0.2:
714709
version "4.0.4"
715710
resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-4.0.4.tgz#bfb10662feed8196a2c62e7c68e17720c274179a"
716711
integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==
717712

718-
brace-expansion@^2.0.1:
719-
version "2.0.2"
720-
resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-2.0.2.tgz#54fc53237a613d854c7bd37463aad17df87214e7"
721-
integrity sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==
722-
dependencies:
723-
balanced-match "^1.0.0"
724-
725713
brace-expansion@^5.0.2:
726714
version "5.0.3"
727715
resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.3.tgz#6a9c6c268f85b53959ec527aeafe0f7300258eef"
@@ -1250,20 +1238,13 @@ mimic-function@^5.0.0:
12501238
resolved "https://registry.yarnpkg.com/mimic-function/-/mimic-function-5.0.1.tgz#acbe2b3349f99b9deaca7fb70e48b83e94e67076"
12511239
integrity sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==
12521240

1253-
minimatch@^10.2.1, minimatch@^10.2.2:
1254-
version "10.2.2"
1255-
resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.2.tgz#361603ee323cfb83496fea2ae17cc44ea4e1f99f"
1256-
integrity sha512-+G4CpNBxa5MprY+04MbgOw1v7So6n5JY166pFi9KfYwT78fxScCeSNQSNzp6dpPSW2rONOps6Ocam1wFhCgoVw==
1241+
minimatch@>=9.0.7, minimatch@^10.2.1, minimatch@^10.2.2, minimatch@^9.0.5:
1242+
version "10.2.4"
1243+
resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.4.tgz#465b3accbd0218b8281f5301e27cedc697f96fde"
1244+
integrity sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==
12571245
dependencies:
12581246
brace-expansion "^5.0.2"
12591247

1260-
minimatch@^9.0.5:
1261-
version "9.0.5"
1262-
resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-9.0.5.tgz#d74f9dd6b57d83d8e98cfb82133b03978bc929e5"
1263-
integrity sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==
1264-
dependencies:
1265-
brace-expansion "^2.0.1"
1266-
12671248
ms@^2.1.3:
12681249
version "2.1.3"
12691250
resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2"

0 commit comments

Comments
 (0)