Skip to content

[deps] Fix vulnerability in minimatch <11.0.1 - #6238

Merged
vrubezhny merged 1 commit into
redhat-developer:mainfrom
vrubezhny:deps/fix-vulnerability-in-minimatch-lessthan-11.0.1
Nov 12, 2026
Merged

vrubezhny merged 1 commit into
redhat-developer:mainfrom
vrubezhny:deps/fix-vulnerability-in-minimatch-lessthan-11.0.1

Conversation

@vrubezhny

@vrubezhny vrubezhny commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor
name:     minimatch
range:    <11.0.1
severity: moderate
issue:    minimatch has potential denial of service via globparts amplification
advisory: https://github.com/advisories/GHSA-g3hv-75wg-m249
effects:  @eslint/config-array, @typescript-eslint/typescript-estree, @vscode/vsce, eslint, eslint-plugin-import-x, glob, mocha, npm-run-all, remap-istanbul, test-exclude

Issue: https://github.com/redhat-developer/vscode-openshift-tools/security/dependabot/235

@vrubezhny
vrubezhny force-pushed the deps/fix-vulnerability-in-minimatch-lessthan-11.0.1 branch from 15ffee0 to 675669b Compare November 2, 2026 13:30
@codecov

codecov Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.95%. Comparing base (35cdc6a) to head (77c407a).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #6238   +/-   ##
=======================================
  Coverage   51.95%   51.95%           
=======================================
  Files         131      131           
  Lines       12333    12333           
  Branches     2826     2826           
=======================================
  Hits         6407     6407           
  Misses       5922     5922           
  Partials        4        4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@vrubezhny
vrubezhny force-pushed the deps/fix-vulnerability-in-minimatch-lessthan-11.0.1 branch 2 times, most recently from 4ff68a5 to 0c6f85a Compare November 2, 2026 20:54
@vrubezhny
vrubezhny marked this pull request as draft November 2, 2026 22:14
@vrubezhny vrubezhny changed the title [deps] Fix vulnerable dependencies: minimath <11.0.1 [deps] Fix vulnerable dependencies: minimatch <11.0.1 Nov 2, 2026
@vrubezhny
vrubezhny force-pushed the deps/fix-vulnerability-in-minimatch-lessthan-11.0.1 branch 2 times, most recently from ebe4063 to baa8357 Compare November 4, 2026 21:49
@vrubezhny vrubezhny changed the title [deps] Fix vulnerable dependencies: minimatch <11.0.1 [deps] Fix vulnerability in minimatch <11.0.1 Nov 4, 2026
```
$ npm audit report

name:     minimatch
range:    <11.0.1
severity: moderate
issue:    minimatch has potential denial of service via globparts amplification
advisory: GHSA-g3hv-75wg-m249
effects:  @eslint/config-array, @typescript-eslint/typescript-estree, @vscode/vsce, eslint, eslint-plugin-import-x, glob, mocha, npm-run-all, remap-istanbul, test-exclude
```

Issue: https://github.com/redhat-developer/vscode-openshift-tools/security/dependabot/235

Signed-off-by: Victor Rubezhny <vrubezhny@redhat.com>
@vrubezhny
vrubezhny force-pushed the deps/fix-vulnerability-in-minimatch-lessthan-11.0.1 branch from baa8357 to 77c407a Compare November 12, 2026 12:16
@vrubezhny
vrubezhny marked this pull request as ready for review November 12, 2026 16:40
@vrubezhny
vrubezhny merged commit f5657e4 into redhat-developer:main Nov 12, 2026
4 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant