Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/api-extractor/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@
"@rushstack/ts-command-line": "workspace:*",
"diff": "~8.0.2",
"lodash": "~4.17.23",
"minimatch": "10.2.1",
"minimatch": "10.2.3",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment is for the code owners of the package as well.

If possible, I would recommend using the semver dependency pattern for patches, ~x.x.x, instead of the exact version x.x.x so that future reported vulnerabilities are easier to handle. Thoughts?

That being said, an exact version update to minimatch would be great too, whatever it takes to unblock teams that are working with the vulnerability. Thanks!

Suggested change
"minimatch": "10.2.3",
"minimatch": "~10.2.3",

"resolve": "~1.22.1",
"semver": "~7.5.4",
"source-map": "~0.6.1",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"changes": [
{
"packageName": "@microsoft/api-extractor",
"comment": "Bump minimatch version from 10.2.1 to 10.2.3",
"type": "patch"
}
],
"packageName": "@microsoft/api-extractor"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"changes": [
{
"packageName": "@rushstack/package-extractor",
"comment": "Bump minimatch version from 10.2.1 to 10.2.3",
"type": "patch"
}
],
"packageName": "@rushstack/package-extractor"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"changes": [
{
"packageName": "@rushstack/webpack4-localization-plugin",
"comment": "Bump minimatch version from 10.2.1 to 10.2.3",
"type": "patch"
}
],
"packageName": "@rushstack/webpack4-localization-plugin"
}
22 changes: 7 additions & 15 deletions common/config/subspaces/build-tests-subspace/pnpm-lock.yaml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
// DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
{
"pnpmShrinkwrapHash": "c7fc0d748fad95ed6142faa9eaff041335b3fc17",
"pnpmShrinkwrapHash": "c395a90b30bd67a31beb1d1b08be9aecb02de265",
"preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9",
"packageJsonInjectedDependenciesHash": "c79f0a961494e6e313bb0ec2c8fe0433cb6baaf5"
"packageJsonInjectedDependenciesHash": "8410b26d03a38d02cb52140340c78128eb2e5fdd"
}
2 changes: 1 addition & 1 deletion common/config/subspaces/default/common-versions.json
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"eslint": "~9.37.0",

// Updated minimatch and its types to latest major version to resolve ReDoS vulnerability
"minimatch": "10.2.1"
"minimatch": "10.2.3"
},

/**
Expand Down
16 changes: 8 additions & 8 deletions common/config/subspaces/default/pnpm-lock.yaml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions common/config/subspaces/default/repo-state.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
// DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
{
"pnpmShrinkwrapHash": "332ad6b0bd71bdfb6f4ae69270e34275b8dc2f1e",
"preferredVersionsHash": "93bf435032db8da4a18734f1eaa359c12ad147c1"
"pnpmShrinkwrapHash": "0778382a980762005a055ec6e76ca8cc37d447f1",
"preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c"
}
2 changes: 1 addition & 1 deletion libraries/package-extractor/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"@rushstack/ts-command-line": "workspace:*",
"ignore": "~5.1.6",
"jszip": "~3.8.0",
"minimatch": "10.2.1",
"minimatch": "10.2.3",
"npm-packlist": "~5.1.3",
"semver": "~7.5.4"
},
Expand Down
2 changes: 1 addition & 1 deletion webpack/webpack4-localization-plugin/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
"@rushstack/terminal": "workspace:*",
"@types/tapable": "1.0.6",
"loader-utils": "1.4.2",
"minimatch": "10.2.1"
"minimatch": "10.2.3"
},
"devDependencies": {
"@rushstack/heft": "workspace:*",
Expand Down