fix: Update glob to 10.5.0 to address CVE-2025-64756 #1591
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Force all glob dependencies to use version 10.5.0 or higher via pnpm hook to prevent command injection vulnerability (CVE-2025-64756) that affects glob versions 10.2.0 through 10.4.x. The vulnerability allows arbitrary command execution when the glob CLI tool is used with the -c/--cmd flag and processes files with malicious names. While this primarily affects CLI usage, updating ensures no security scanners will flag vulnerable versions in the dependency tree. Changes: - Updated .pnpmfile.cjs hook to override vulnerable glob versions - Regenerated pnpm-lock.yaml with glob 10.5.0 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
PR Summary
|
Collaborator
Author
|
/integration sha=224dfd7 |
Contributor
|
⌛ Integration tests are running... Check their status here 👈 |
Contributor
|
❌ Oh no! Integration tests have failed |
Fix type error caused by stricter type checking in @types/node 20.19.x where RequestOptions.headers could be OutgoingHttpHeaders or readonly string array. Added explicit type cast to OutgoingHttpHeaders when setting Content-Length header. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Force all glob dependencies to use version 10.5.0 or higher via pnpm hook to prevent command injection vulnerability (CVE-2025-64756) that affects glob versions 10.2.0 through 10.4.x.
The vulnerability allows arbitrary command execution when the glob CLI tool is used with the -c/--cmd flag and processes files with malicious names. While this primarily affects CLI usage, updating ensures no security scanners will flag vulnerable versions in the dependency tree.
Changes:
🤖 Generated with Claude Code
Description
Changes
Checks