From 8cd97de829d46331ae39231f289687141046c4eb Mon Sep 17 00:00:00 2001 From: Kohei Otsuka Date: Mon, 2 Nov 2026 22:10:24 +0900 Subject: [PATCH] fix(deps): raise minimatch under @microsoft/api-extractor to 11.x @microsoft/api-extractor pins minimatch 10.2.3, which is affected by GHSA-g3hv-75wg-m249. The fix exists only in 11.x. api-extractor only calls minimatch(), which 11.x keeps, so scope the override to this parent. Co-Authored-By: Claude Opus 5.5 --- ci/pnpm-workspace.ci.yaml | 3 +++ pnpm-lock.yaml | 11 ++--------- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/ci/pnpm-workspace.ci.yaml b/ci/pnpm-workspace.ci.yaml index c93e1e0..6f4b447 100644 --- a/ci/pnpm-workspace.ci.yaml +++ b/ci/pnpm-workspace.ci.yaml @@ -45,3 +45,6 @@ overrides: "eslint>minimatch": "^11.0.1" "@eslint/config-array>minimatch": "^11.0.1" "@typescript-eslint/typescript-estree>minimatch": "^11.0.1" + # 型定義の生成ツール（@microsoft/api-extractor）が固定で引く minimatch 10.2.3 も同じ勧告に当たる。 + # api-extractor が使うのは minimatch() だけなので、親に限って 11 系へ上げる + "@microsoft/api-extractor>minimatch": "^11.0.1" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cbda81f..950ff73 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,6 +13,7 @@ overrides: eslint>minimatch: ^11.0.1 '@eslint/config-array>minimatch': ^11.0.1 '@typescript-eslint/typescript-estree>minimatch': ^11.0.1 + '@microsoft/api-extractor>minimatch': ^11.0.1 importers: @@ -1545,10 +1546,6 @@ packages: mdn-data@2.27.1: resolution: {integrity: sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==} - minimatch@10.2.3: - resolution: {integrity: sha512-Rwi3pnapEqirPSbWbrZaa6N3nmqq4Xer/2XooiOKyV3q12ML06f7MOuc5DVH8ONZIFhwIYQ3yzPH4nt7iWHaTg==} - engines: {node: 18 || 20 || >=22} - minimatch@11.0.3: resolution: {integrity: sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==} engines: {node: 18 || 20 || >=22} @@ -2266,7 +2263,7 @@ snapshots: '@rushstack/terminal': 0.24.7(@types/node@26.6.5) '@rushstack/ts-command-line': 5.3.17(@types/node@26.6.5) diff: 8.0.4 - minimatch: 10.2.3 + minimatch: 11.0.3 resolve: 1.22.13 semver: 7.7.4 source-map: 0.6.1 @@ -4175,10 +4172,6 @@ snapshots: mdn-data@2.27.1: {} - minimatch@10.2.3: - dependencies: - brace-expansion: 5.0.12 - minimatch@11.0.3: dependencies: '@isaacs/nonrecursive-glob-match': 1.0.3