From 38bebb98e9f532f9aed4c460d62c976bc9a047f5 Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Sat, 25 Jul 2026 15:49:00 +0200 Subject: [PATCH] fix(deps): collapse minimatch onto 10 to clear brace-expansion advisory GHSA-mh99-v99m-4gvg is only fixed in brace-expansion 5.0.8 and flags the whole range at or below 5.0.7, so the 1.x and 2.x copies stayed flagged even after being patched to 1.1.16 and 2.1.2. Those copies only existed because glob@7 (archiver-utils, rimraf@2) and readdir-glob@1 (archiver, via exceljs) depend on minimatch 3.x/5.x. Lifting minimatch itself to 10 removes them: minimatch 10 depends on brace-expansion ^5, so 5.0.8 becomes the single copy in the tree and the 1.x/2.x overrides are no longer needed. Both consumers use `new Minimatch(...)` rather than calling the module export as a function, which is the incompatibility in minimatch 10 (its CommonJS export is an object). Verified against the real consumer path: exceljs writes a byte-identical workbook under minimatch 3.1.5 and 10.2.5, and glob@7 results, negation, partial matching and filter are identical between both versions. --- pnpm-lock.yaml | 47 +++------------------------------------------ pnpm-workspace.yaml | 11 ++++++++--- 2 files changed, 11 insertions(+), 47 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 85513ac..76e9399 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,8 +12,7 @@ overrides: uuid@<11.1.1: '>=11.1.1' fast-uri@<3.1.3: '>=3.1.3 <4' sharp@<0.35.0: '>=0.35.0' - brace-expansion@<1.1.16: '>=1.1.16 <2' - brace-expansion@>=2.0.0 <2.1.2: '>=2.1.2 <3' + minimatch@<10: '>=10 <11' brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8' importers: @@ -1436,9 +1435,6 @@ packages: resolution: {integrity: sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==} engines: {node: '>= 6.0.0'} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -1479,12 +1475,6 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@1.1.16: - resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} - brace-expansion@5.0.8: resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} engines: {node: 20 || >=22} @@ -1585,9 +1575,6 @@ packages: resolution: {integrity: sha512-D3uMHtGc/fcO1Gt1/L7i1e33VOvD4A9hfQLP+6ewd+BvG/gQ84Yh4oftEhAdjSMgBgwGL+jsppT7JYNpo6MHHg==} engines: {node: '>= 10'} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - confbox@0.2.4: resolution: {integrity: sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==} @@ -2107,13 +2094,6 @@ packages: resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - - minimatch@5.1.9: - resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==} - engines: {node: '>=10'} - minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -4124,8 +4104,6 @@ snapshots: aws-ssl-profiles@1.1.2: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} base64-js@1.5.1: {} @@ -4155,15 +4133,6 @@ snapshots: bowser@2.14.1: {} - brace-expansion@1.1.16: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - - brace-expansion@2.1.2: - dependencies: - balanced-match: 1.0.2 - brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -4271,8 +4240,6 @@ snapshots: normalize-path: 3.0.0 readable-stream: 3.6.2 - concat-map@0.0.1: {} - confbox@0.2.4: {} convert-source-map@2.0.0: {} @@ -4595,7 +4562,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.5 + minimatch: 10.2.5 once: 1.4.0 path-is-absolute: 1.0.1 @@ -4779,14 +4746,6 @@ snapshots: dependencies: brace-expansion: 5.0.8 - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.16 - - minimatch@5.1.9: - dependencies: - brace-expansion: 2.1.2 - minimist@1.2.8: {} mkdirp@0.5.6: @@ -5101,7 +5060,7 @@ snapshots: readdir-glob@1.1.3: dependencies: - minimatch: 5.1.9 + minimatch: 10.2.5 readdirp@3.6.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index d13bb4d..e98ad50 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -30,7 +30,12 @@ overrides: # directly; this only lifts the older copy next pulls in as an optional dep. "sharp@<0.35.0": ">=0.35.0" # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg — brace-expansion DoS via expansion - # blowup. Three major lines are in the tree, so patch each within its own line. - "brace-expansion@<1.1.16": ">=1.1.16 <2" - "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3" + # blowup. The second advisory is only fixed in 5.0.8 and flags everything at or + # below 5.0.7, so the old 1.x/2.x lines stay flagged no matter how far we patch + # inside them. They only existed because glob@7 (archiver-utils, rimraf@2) and + # readdir-glob@1 (archiver, via exceljs) pull minimatch 3.x/5.x, so lift + # minimatch itself to 10 — it depends on brace-expansion ^5, which leaves 5.0.8 + # as the single copy in the tree. Both consumers construct `new Minimatch(...)` + # rather than calling the export as a function, which is what breaks under 10. + "minimatch@<10": ">=10 <11" "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8"