fix: update minimatch override to resolve high severity ReDoS vulnerabilities#1695
fix: update minimatch override to resolve high severity ReDoS vulnerabilities#1695
Conversation
…ties Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughUpdate PNPM dependency override for minimatch package. The version constraint in package.json changes from Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR correctly updates the minimatch dependency override to resolve 2 high severity ReDoS vulnerabilities (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74) affecting versions >=10.0.0 <10.2.3.
Confidence Score: 5/5
Important Files Changed
Last reviewed commit: ffad371 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR updates the pnpm override for the minimatch package to address two high severity ReDoS (Regular Expression Denial of Service) vulnerabilities in versions >=10.0.0 <10.2.3. The override pattern is adjusted to exclude versions below 10.2.3 and resolve to 10.2.4, which contains the security fixes.
Changes:
- Updated
minimatchoverride from<10.2.2 -> >=10.2.2to<10.2.3 -> ^10.2.3 - Resolved all transitive minimatch dependencies to version 10.2.4 in the lockfile
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updated pnpm.overrides entry for minimatch to exclude vulnerable versions |
| pnpm-lock.yaml | Updated all minimatch package resolutions and snapshots to version 10.2.4 |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| "tar@<=7.5.8": ">=7.5.9", | ||
| "ajv@<8.18.0": ">=8.18.0", | ||
| "minimatch@<10.2.2": ">=10.2.2", | ||
| "minimatch@<10.2.3": ">=10.2.3", |
There was a problem hiding this comment.
pnpm-lock.yaml contains outdated minimatch override constraint that doesn't match package.json, causing frozen lockfile configuration mismatch error
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated 4 comments.
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "tar@<=7.5.8": ">=7.5.9", | ||
| "ajv@<8.18.0": ">=8.18.0", | ||
| "minimatch@<10.2.2": ">=10.2.2", | ||
| "minimatch@<10.2.3": ">=10.2.3", |
There was a problem hiding this comment.
The override selector minimatch@<10.2.3 applies to all minimatch versions below 10.2.3 (including older major versions). Since the reported advisory range is for >=10.0.0 <10.2.3, it would be safer to scope the selector accordingly (e.g. add a >=10.0.0 lower bound) so future dependencies on older minimatch majors aren’t forcibly upgraded to 10.x.
| "minimatch@<10.2.3": ">=10.2.3", | |
| "minimatch@>=10.0.0 <10.2.3": ">=10.2.3", |
| "tar@<=7.5.8": ">=7.5.9", | ||
| "ajv@<8.18.0": ">=8.18.0", | ||
| "minimatch@<10.2.2": ">=10.2.2", | ||
| "minimatch@<10.2.3": ">=10.2.3", |
There was a problem hiding this comment.
The override value is >=10.2.3, which can allow a future major minimatch release to be selected. To reduce risk of unintended breaking changes from a security override, consider constraining the override value to the desired major (e.g. ^10.2.3 or >=10.2.3 <11).
| "minimatch@<10.2.3": ">=10.2.3", | |
| "minimatch@<10.2.3": ">=10.2.3 <11", |
| "tar@<=7.5.8": ">=7.5.9", | ||
| "ajv@<8.18.0": ">=8.18.0", | ||
| "minimatch@<10.2.2": ">=10.2.2", | ||
| "minimatch@<10.2.3": ">=10.2.3", |
There was a problem hiding this comment.
PR description says the package.json override was changed to ^10.2.3, but the actual override value here is >=10.2.3. Please align the description with the implemented change (or vice-versa) to avoid confusion for reviewers/auditors.
| tar@<=7.5.8: '>=7.5.9' | ||
| ajv@<8.18.0: '>=8.18.0' | ||
| minimatch@<10.2.2: '>=10.2.2' | ||
| minimatch@<10.2.3: ^10.2.3 |
There was a problem hiding this comment.
pnpm-lock.yaml records the minimatch override as ^10.2.3, which does not match package.json (currently >=10.2.3) and also differs from the quoting style used for other override values in the lockfile. Regenerate the lockfile after finalizing the intended override so package.json and pnpm-lock.yaml stay in sync and installs don’t produce churn.
| minimatch@<10.2.3: ^10.2.3 | |
| minimatch@<10.2.3: '>=10.2.3' |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Line 46: Update the override value for the "minimatch@<10.2.3" entry so it is
constrained to major version 10 rather than open-ended; replace the current
">=10.2.3" range with a range bounded below by 10.2.3 and strictly below 11 (for
example ">=10.2.3 <11.0.0") so future major releases of minimatch are not
automatically pulled.
ℹ️ Review info
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
| "tar@<=7.5.8": ">=7.5.9", | ||
| "ajv@<8.18.0": ">=8.18.0", | ||
| "minimatch@<10.2.2": ">=10.2.2", | ||
| "minimatch@<10.2.3": ">=10.2.3", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# First, check if package.json exists and show line 46
echo "=== Current package.json line 46 ==="
if [ -f "package.json" ]; then
sed -n '46p' package.json
else
echo "package.json not found"
exit 1
fi
# Check the full pnpm overrides section if it exists
echo ""
echo "=== Full pnpm.overrides section ==="
jq '.pnpm.overrides // "No pnpm overrides found"' package.json 2>/dev/null || echo "Could not read pnpm.overrides"
# Check minimatch current version info from npm registry
echo ""
echo "=== Minimatch on npm registry ==="
if command -v curl &> /dev/null; then
MINIMATCH_INFO=$(curl -s https://registry.npmjs.org/minimatch 2>/dev/null || echo "")
if [ -n "$MINIMATCH_INFO" ]; then
echo "Latest tag: $(echo "$MINIMATCH_INFO" | jq -r '."dist-tags".latest // "N/A"' 2>/dev/null)"
echo "Available versions (last 10):"
echo "$MINIMATCH_INFO" | jq -r '.versions | keys | .[-10:] | .[]' 2>/dev/null || echo "Could not extract versions"
else
echo "Could not fetch from npm registry"
fi
else
echo "curl not available"
fiRepository: namehash/ensnode
Length of output: 740
Constrain the override to the patched major to avoid accidental future breakage.
Using >=10.2.3 is open-ended and will pull future major releases of minimatch when they are published. For a security-only fix, pinning within major 10 is safer and still resolves the ReDoS vulnerability in <10.2.3.
🔧 Proposed fix
- "minimatch@<10.2.3": ">=10.2.3",
+ "minimatch@<10.2.3": "^10.2.3",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "minimatch@<10.2.3": ">=10.2.3", | |
| "minimatch@<10.2.3": "^10.2.3", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 46, Update the override value for the
"minimatch@<10.2.3" entry so it is constrained to major version 10 rather than
open-ended; replace the current ">=10.2.3" range with a range bounded below by
10.2.3 and strictly below 11 (for example ">=10.2.3 <11.0.0") so future major
releases of minimatch are not automatically pulled.
|
superseded by #1696 |
Summary
pnpm.overridesforminimatchfrom<10.2.2 -> >=10.2.2to<10.2.3 -> ^10.2.3tsup > sucrase > glob > minimatch) to 10.2.4Why
pnpm auditreported 2 high severity ReDoS vulnerabilities in minimatch >=10.0.0 <10.2.3 (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74)Testing
pnpm audit --audit-level=moderatebefore and after — 2 high vulnerabilities resolved, 0 moderate+ remainingChecklist
🤖 Generated with Claude Code