[JOY (JOY)]

Closes #1536

Problem

• minimatch: pnpm-lock.yaml resolved minimatch 10.2.6. That is inside a moderate ReDoS (regex denial of service) advisory range, patched in 11.0.1. It is reached through glob 13 (@sentry/bundler-plugins) and the typescript-eslint (@typescript-eslint) path.
• follow-redirects: a high-severity advisory affects Rate-Services through axios. This repo needed checking too.

Change (package.json pnpm.overrides, lockfile)

• "minimatch@^10": "^11.0.1", the same entry Rate-Services uses (RS#825). It resolves to minimatch 11.0.3.
• "glob@^13": "^14.0.3", which is new and needed:
  • With minimatch 11, glob 13.0.6 matches nothing. glob('*.json') returns [], against 4 files with minimatch 10.
  • minimatch 11 stores parsed patterns in a new shape that glob 13 does not read.
  • glob 13 is what @sentry/bundler-plugins (core/glob.js, globFiles) uses to find build files and source maps. So the minimatch override alone would quietly break the Sentry source-map step at build time, while lint, tests and E2E all stay green.
  • glob 14.0.3 depends on minimatch ^11.0.2. It keeps the glob() API that Sentry calls, and it is outside glob's own advisory range (>=9.0.0 <=14.0.1), which pnpm audit also listed for 13.0.6.
• "fast-uri@>=3.0.0 <3.1.9": "^3.1.9": the existing override moves up one patch, from 3.1.8 to 3.1.9, because 3.1.8 is inside a newer advisory range (<3.1.9). The PO asked for it in this PR, as the same kind of XS security change.
• The lockfile diff:
  • minimatch 10.2.6 becomes 11.0.3, and glob 13.0.6 becomes 14.0.3;
  • it adds @isaacs/nonrecursive-glob-match 1.0.3, a minimatch 11 dependency by the same author.

Not changed

• follow-redirects: not in the lockfile. There is no axios and no follow-redirects anywhere in the tree, so the advisory does not reach DOS/Rate.
• minimatch 3.1.5, pulled by ESLint 9: there is no patched 3.x, so it stays, as the issue says. pnpm audit still lists it (moderate, <11.0.1).

Checks

• pnpm audit:

  	before	after
  moderate advisories	4	1
  low advisories	2	0
  minimatch 10.x	listed	gone
  glob 13	listed	gone
  fast-uri 3.1.8	listed	gone
  left		minimatch 3.1.5 only

• Sentry's own helper, run against the installed packages:

  • its CJS globFiles(['apps/web/e2e/*.spec.ts', '*.json']) returns 90 files (86 specs and 4 JSON files);
  • its ESM version returns 86 for the spec pattern;
  • with glob 13 and minimatch 11, both returned 0.

• Lint and types:

  • turbo lint --force (no cache): 4 of 4 tasks pass. ESLint runs typescript-eslint (@typescript-eslint), which also uses minimatch.
  • apps/web tsc is clean.

• Unit tests and E2E run in CI.

Review

• Fresh-context review: no P1 or P2.
  • Consumers checked: the only minimatch 10 consumers were @typescript-eslint/typescript-estree and glob 13. typescript-estree only calls minimatch(path, pattern, {dot}) for allowDefaultProject, which no config here sets.
  • APIs: minimatch 11 removes makeRe, AST and some prototype helpers. Neither consumer uses them.
  • Matching: 200 cases (braces, extglob, drive roots) give identical results on 10.2.6 and 11.0.3.
  • glob: it confirmed that glob 13 with minimatch 11 matches nothing. glob 14 matches Sentry's exact calls (root, extglob /**/*.js?(\?*)?(#*), ignore) the same as glob 13 with minimatch 10.
  • Override keys: they catch only ^10 and ^13. minimatch 3.1.5 and glob 7.2.3 are untouched.
• Codex was skipped (optional for a lockfile-only change).

🤖 Generated with Claude Code

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
rate	Ready	Preview	Oct 31, 2026 5:35am UTC

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b5cea11a-8846-4581-8716-416bac545a69

Commits

Reviewing files that changed from the base of the PR and between 4aae9ad and f4b0bf1.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The root pnpm.overrides configuration adds version overrides for minimatch and glob. The existing js-yaml override remains unchanged.

Changes: Dependency override updates

Layer / File(s)	Summary
Dependency version overrides package.json	The configuration adds minimatch@^10 → ^11.0.1 and glob@^13 → ^14.0.3 overrides. The existing js-yaml override remains unchanged.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other · Severity of issue fixed: Medium

Suggested reviewers: dos

Merge Risk: Minimal · up to f4b0b

No merge-blocking issue is established for these dependency overrides. Merge after the normal build and test checks pass.

Pre-merge checks: 3 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		For #1536, the PR reports the required minimatch override, glob compatibility fix, removal of the minimatch 10.x audit finding, absence of follow-redirects, retention of minimatch 3.1.5, and passing l…	Provide reviewable evidence that the unit and E2E checks pass, and confirm the lockfile resolves minimatch 11.0.3 and glob 14.0.3.

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly identifies the dependency override and lockfile change for minimatch and glob. It is concise and directly related to the main changes.
Out of Scope Changes check		The reported changes are limited to dependency overrides and the lockfile. The minimatch and glob changes support #1536 by addressing the advisory and preserving Sentry glob behavior. No unrelated cha…
Description check		The description is detailed and directly addresses the dependency changes, security rationale, affected packages, compatibility risks, validation results, and linked issue. It does not use the reposit…

Full details: Out of Scope Changes check

Explanation

The reported changes are limited to dependency overrides and the lockfile. The minimatch and glob changes support #1536 by addressing the advisory and preserving Sentry glob behavior. No unrelated change is demonstrated.

Full details: Description check

Explanation

The description is detailed and directly addresses the dependency changes, security rationale, affected packages, compatibility risks, validation results, and linked issue. It does not use the repository template headings and omits the explicit checklist, affected areas, reviewers, and optional screenshots, but the required technical information is mostly present.

Full details: Linked Issues check

Explanation

For #1536, the PR reports the required minimatch override, glob compatibility fix, removal of the minimatch 10.x audit finding, absence of follow-redirects, retention of minimatch 3.1.5, and passing lint and typecheck. The PR reports that unit and E2E tests run in CI, but it does not establish that both checks passed. The lockfile is excluded from review, so its resolved versions rely on the PR report.

Resolution

Provide reviewable evidence that the unit and E2E checks pass, and confirm the lockfile resolves minimatch 11.0.3 and glob 14.0.3.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn