Repository navigation
[rushstack] Upgrade minimatch to 11.0.2 to fix GHSA-g3hv-75wg-m249 - #6195
Roman (rowmanempire) wants to merge 1 commit into
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Roman (@rowmanempire) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
4 similar comments
|
Roman (@rowmanempire) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
|
Roman (@rowmanempire) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
|
Roman (@rowmanempire) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
|
Roman (@rowmanempire) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
Summary
Fixes #6192.
minimatch< 11.0.1 is flagged by GHSA-g3hv-75wg-m249 (CVE-2026-118764). There is no patched 10.x release, so security scanners keep flagging@microsoft/api-extractor,@rushstack/package-extractor, and@rushstack/webpack4-localization-pluginfor everyone who installs them.This PR upgrades
minimatchfrom 10.2.3 to 11.0.2 in all three packages and incommon-versions.json. It covers the same packages as #5675, so it supersedes the Dependabot PR #6190, which only updatespackage-extractor.Details
makeRe(),Minimatch#regexp, theASTclass, and thedebugoption. None of the three packages use them. They only callminimatch(path, pattern)(api-extractorCollector.ts,webpack4-localization-pluginWebpackConfigurationUpdater.ts) andnew Minimatch(pattern, { dot: true }).match(path)(package-extractorPackageExtractor.ts), which 11 keeps.18 || 20 || >=22, and its new dependencybrace-expansion@5declares20 || >=22. minimatch 10.2.3 already declared18 || 20 || >=22, so the only change is dropping Node 18, which is outside these packages'>=20.9.0range anyway.How it was tested
On Node 24.22.2:
rush update, thenrush install: passed.rush build --to @microsoft/api-extractor --to @rushstack/package-extractor --to @rushstack/webpack4-localization-plugin: 28 operations passed.rush test --onlyfor the three packages: passed, includingPackageExtractor.test.ts, which coverspatternsToInclude/patternsToExclude.rush buildforapi-extractor-scenarios,api-extractor-test-01..05,package-extractor-test-01..05, andlocalization-plugin-test-01..03: 54 operations passed. ThebundledPackagesscenario, which uses glob patterns such asapi-extractor-lib2*and*-lib{2,4,5}**, produced no report changes.Impacted documentation
None.