Repository navigation
rebuild default bundle with patched deps - #658
Closed
dyk1454683243-sudo wants to merge 3 commits into
Closed
dyk1454683243-sudo wants to merge 3 commits into
dyk1454683243-sudo wants to merge 3 commits into
Conversation
The published CommonJS and ESM min bundles freeze copies of minimatch and brace-expansion. Refresh the lockfile so those copies include the nested-extglob and numeric-range fixes, and assert the bundled versions stay current. fix: isaacs#657 Co-authored-by: David <dyk1454683243-sudo@users.noreply.github.com>
Importing index.min.js pulled bundled dependency sources into coverage via source maps and failed the complete-coverage check. Co-authored-by: David <dyk1454683243-sudo@users.noreply.github.com>
Versions 5.0.6 through 5.0.8 still sit in later DoS advisory ranges. Keep the lockfile on the patched 5.0.12 release. re: isaacs#657 Co-authored-by: David <dyk1454683243-sudo@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The default
globentry shipsdist/*/index.min.js, which bundlesminimatch and brace-expansion.
glob/rawloads those packages fromnode_modules. Afterglob@13.0.6, a consumer can resolve patchedminimatch@10.2.6/brace-expansion@5.0.12forglob/rawwhile thepublished default bundle still contains the pre-fix copies.
On current main the lockfile still pinned
brace-expansion@5.0.5(affected by GHSA-jxxr-4gwj-5jf2 and later brace-expansion advisories
through 5.0.8). Rebuilding without refreshing the lockfile would keep
shipping that copy.
This updates the lockfile to
minimatch@10.2.6andbrace-expansion@5.0.12, and adds a regression test that:minimatch >= 10.2.3andbrace-expansion >= 5.0.9(5.0.6 fixed the glob@13.0.6 default bundle retains pre-fix minimatch and brace-expansion copies #657 numeric-rangeadvisory; 5.0.9 is the first release outside later DoS ranges)
sourcesContentmatches the installed packagesbrace-expansion@5.0.8+advertisesengines.node20 || >=22. globalready dropped Node 18 from CI. Pinning 5.0.7 would keep the Node 18
engine advertisement but remain in the advisory range.
A new glob release is needed for npm consumers. Updating a consumer
lockfile does not replace code already compiled into
index.min.js.fix: #657