From f4b0bf1a7d1630456c9ce3b905b8f8d32bbe0925 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Sat, 31 Oct 2026 12:27:03 +0700 Subject: [PATCH 1/2] chore(deps): patch minimatch 10.x in the lockfile, with glob 14 to match (#1536) minimatch 10.2.6 sits in a ReDoS advisory range (patched in 11.0.1); an override moves it to 11.0.3. glob 13.0.6, used by @sentry/bundler-plugins to find source maps, matches nothing with minimatch 11, so glob 13 moves to 14.0.3, which depends on minimatch 11 and is outside glob's own advisory. The lockfile has no follow-redirects. minimatch 3.1.5 from ESLint 9 has no patched 3.x and stays. Co-Authored-By: Claude Opus 5.5 --- package.json | 4 +++- pnpm-lock.yaml | 34 +++++++++++++++++++++------------- 2 files changed, 24 insertions(+), 14 deletions(-) diff --git a/package.json b/package.json index a10392aaa..2f1bc7fba 100644 --- a/package.json +++ b/package.json @@ -89,7 +89,9 @@ "fast-uri@>=3.0.0 <3.1.8": "^3.1.8", "ajv@>=6.0.0 <6.14.0": "^6.14.0", "postcss-selector-parser@<7.1.6": "^7.1.6", - "js-yaml@<4.1.0": "^4.1.1" + "js-yaml@<4.1.0": "^4.1.1", + "minimatch@^10": "^11.0.1", + "glob@^13": "^14.0.3" } }, "dependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5ae6d637f..b8019dca5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -20,6 +20,8 @@ overrides: ajv@>=6.0.0 <6.14.0: ^6.14.0 postcss-selector-parser@<7.1.6: ^7.1.6 js-yaml@<4.1.0: ^4.1.1 + minimatch@^10: ^11.0.1 + glob@^13: ^14.0.3 pnpmfileChecksum: sha256-k+Zvh3fP7lc7vGzTwYKSXCsxpRec9HXBwanW0X8RJO0= @@ -976,6 +978,9 @@ packages: '@types/node': optional: true + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@jridgewell/gen-mapping@0.3.13': resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==} @@ -2818,8 +2823,8 @@ packages: resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==} engines: {node: '>=10.13.0'} - glob@13.0.6: - resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} + glob@14.0.3: + resolution: {integrity: sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==} engines: {node: 18 || 20 || >=22} glob@7.2.3: @@ -3317,8 +3322,8 @@ packages: resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==} engines: {node: '>=6'} - minimatch@10.2.6: - resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} + minimatch@11.0.3: + resolution: {integrity: sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==} engines: {node: 18 || 20 || >=22} minimatch@3.1.5: @@ -3542,8 +3547,8 @@ packages: path-parse@1.0.7: resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==} - path-scurry@2.0.2: - resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} engines: {node: 18 || 20 || >=22} picocolors@1.1.1: @@ -4737,6 +4742,8 @@ snapshots: optionalDependencies: '@types/node': 26.6.5 + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@jridgewell/gen-mapping@0.3.13': dependencies: '@jridgewell/sourcemap-codec': 1.6.0 @@ -5115,7 +5122,7 @@ snapshots: dependencies: '@sentry/core': 11.1.0 dotenv: 17.4.2 - glob: 13.0.6 + glob: 14.0.3 magic-string: 0.30.21 oxc-parser: 0.143.0 sentry: 0.44.1 @@ -5493,7 +5500,7 @@ snapshots: '@typescript-eslint/types': 8.71.2 '@typescript-eslint/visitor-keys': 8.71.2 debug: 4.4.3 - minimatch: 10.2.6 + minimatch: 11.0.3 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0 @@ -6538,11 +6545,11 @@ snapshots: dependencies: is-glob: 4.0.3 - glob@13.0.6: + glob@14.0.3: dependencies: - minimatch: 10.2.6 + minimatch: 11.0.3 minipass: 7.1.3 - path-scurry: 2.0.2 + path-scurry: 3.0.0 glob@7.2.3: dependencies: @@ -7002,8 +7009,9 @@ snapshots: mimic-fn@2.1.0: {} - minimatch@10.2.6: + minimatch@11.0.3: dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 minimatch@3.1.5: @@ -7229,7 +7237,7 @@ snapshots: path-parse@1.0.7: {} - path-scurry@2.0.2: + path-scurry@3.0.0: dependencies: lru-cache: 11.5.3 minipass: 7.1.3 From e2d473d57f024421079af8540024c40266e2ad95 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Sat, 31 Oct 2026 12:34:27 +0700 Subject: [PATCH 2/2] chore(deps): move the fast-uri override to 3.1.9 (#1536) fast-uri 3.1.8 is inside a newer advisory range (<3.1.9). After this, pnpm audit lists only minimatch 3.1.5 from ESLint 9, which has no patched 3.x. Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 2f1bc7fba..a4b6839c1 100644 --- a/package.json +++ b/package.json @@ -86,7 +86,7 @@ "lodash@>=4.0.0 <4.18.0": "^4.18.1", "tmp@<0.2.6": "^0.2.7", "source-map-js@>=1.0.0 <1.2.2": "^1.2.2", - "fast-uri@>=3.0.0 <3.1.8": "^3.1.8", + "fast-uri@>=3.0.0 <3.1.9": "^3.1.9", "ajv@>=6.0.0 <6.14.0": "^6.14.0", "postcss-selector-parser@<7.1.6": "^7.1.6", "js-yaml@<4.1.0": "^4.1.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b8019dca5..f91e3db04 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -16,7 +16,7 @@ overrides: lodash@>=4.0.0 <4.18.0: ^4.18.1 tmp@<0.2.6: ^0.2.7 source-map-js@>=1.0.0 <1.2.2: ^1.2.2 - fast-uri@>=3.0.0 <3.1.8: ^3.1.8 + fast-uri@>=3.0.0 <3.1.9: ^3.1.9 ajv@>=6.0.0 <6.14.0: ^6.14.0 postcss-selector-parser@<7.1.6: ^7.1.6 js-yaml@<4.1.0: ^4.1.1 @@ -2710,8 +2710,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.8: - resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fastq@1.20.3: resolution: {integrity: sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==} @@ -5711,7 +5711,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.8 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -6423,7 +6423,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.8: {} + fast-uri@3.1.9: {} fastq@1.20.3: dependencies: