Skip to content

upgrade minimatch#401

Open
jameswu1991 wants to merge 1 commit intotrivago:mainfrom
jameswu1991:jwu/minimatch
Open

upgrade minimatch#401
jameswu1991 wants to merge 1 commit intotrivago:mainfrom
jameswu1991:jwu/minimatch

Conversation

@jameswu1991
Copy link
Copy Markdown

Problem

fixes #400

Solution

audit use of minimatch -- call signature is the same between 9 and 10

return minimatch(filename, normalizedPattern, { matchBase: true });

upgrade minimatch from 9 to 10

return minimatch(normalizedPath, normalizedPattern);

Testing

yarn test
 Test Files  31 passed (31)
      Tests  154 passed (154)
   Start at  15:16:11
   Duration  4.32s (transform 290ms, setup 34.53s, collect 662ms, tests 141ms, environment 2ms, prepare 2.94s)

✨  Done in 5.54s.

@jameswu1991
Copy link
Copy Markdown
Author

jameswu1991 commented Mar 2, 2026

looks like the folks at minimatch actually went back to patch v3, so the original issue is fixed. feel free to close if needed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CVE-2026-26996 (minimatch ReDoS vulnerability)

1 participant