Skip to content

fix(deps): patch minimatch ReDoS vulnerabilities via npm audit fix#7754

Open
yhabib wants to merge 1 commit intomainfrom
chore/depsn
Open

fix(deps): patch minimatch ReDoS vulnerabilities via npm audit fix#7754
yhabib wants to merge 1 commit intomainfrom
chore/depsn

Conversation

@yhabib
Copy link
Contributor

@yhabib yhabib commented Feb 27, 2026

Motivation

# npm audit report

minimatch  <=3.1.3 || 10.0.0 - 10.2.2
Severity: high
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/minimatch

svelte  <=5.53.4
Severity: moderate
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - https://github.com/advisories/GHSA-qgvg-pr8v-6rr3
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` - https://github.com/advisories/GHSA-phwv-c562-gvmh
fix available via `npm audit fix`
node_modules/svelte

2 vulnerabilities (1 moderate, 1 high)

To address all issues, run:
  npm audit fix

Changes

  • Ran npm audit fix

Tests

  • CI is green

Todos

  • Accessibility (a11y) – any impact?
  • Changelog – is it needed?

@yhabib yhabib marked this pull request as ready for review February 28, 2026 00:13
@yhabib yhabib requested a review from a team as a code owner February 28, 2026 00:13
@yhabib yhabib enabled auto-merge February 28, 2026 00:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant