Skip to content

Conversation

@aikido-autofix
Copy link
Contributor

Upgrading glob to address vulnerabilities.

1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-64756
HIGH
Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <comma...

@codecov
Copy link

codecov bot commented Dec 13, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (d4c4aab) to head (41be1a3).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #107   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           32        32           
  Lines          847       847           
  Branches       147       147           
=========================================
  Hits           847       847           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jaredwray
Copy link
Owner

@copilot can you move this change to be in the pnpm-workspace.yaml?

Copy link

Copilot AI commented Dec 13, 2025

@jaredwray I've opened a new pull request, #108, to work on those changes. Once the pull request is ready, I'll request review from you.

@jaredwray jaredwray changed the title [Aikido] Fix security issue in glob via minor version upgrade from 11.0.3 to 11.1.0 fix: [Aikido] Fix security issue in glob via minor version upgrade from 11.0.3 to 11.1.0 Dec 13, 2025
@jaredwray jaredwray merged commit 9e8cef1 into main Dec 13, 2025
7 checks passed
@jaredwray jaredwray deleted the fix/aikido-security-update-packages-11983901-mKUJ branch December 13, 2025 19:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants