Skip to content

Bump vulnerable npm dependencies#171

Merged
salvador-barboza merged 1 commit into
mainfrom
salvador-barboza/trace-minimatch
May 14, 2026
Merged

Bump vulnerable npm dependencies#171
salvador-barboza merged 1 commit into
mainfrom
salvador-barboza/trace-minimatch

Conversation

@salvador-barboza

@salvador-barboza salvador-barboza commented May 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • pin ESLint's transitive minimatch resolution to 3.1.3
  • bump direct uuid dependency to 11.1.1
  • refresh the lockfile to capture both patched versions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 14, 2026 17:25

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses reported npm dependency vulnerabilities by updating a direct dependency (uuid) and pinning a patched minimatch version for ESLint-related packages via npm overrides, then refreshing the lockfile to reflect the resolved versions.

Changes:

  • Bump uuid from ^11.1.0 to ^11.1.1.
  • Pin ESLint-family minimatch resolution to 3.1.3 using overrides.
  • Update package-lock.json to capture the new uuid and minimatch resolutions.
Show a summary per file
File Description
package.json Updates uuid and adds npm overrides to pin minimatch for ESLint-related packages.
package-lock.json Refreshes lockfile entries to resolve minimatch@3.1.3 and uuid@11.1.1.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/2 changed files
  • Comments generated: 0

@salvador-barboza salvador-barboza merged commit 5e2e091 into main May 14, 2026
7 checks passed
@salvador-barboza salvador-barboza deleted the salvador-barboza/trace-minimatch branch May 14, 2026 17:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants