Visitar URL original
chore(deps): minimatch updates for security vulnerabilities by yamad · Pull Request #801 · astral-sh/setup-uv · GitHub
Skip to content

chore(deps): minimatch updates for security vulnerabilities - #801

Closed
yamad wants to merge 1 commit into
astral-sh:mainfrom
yamad:minimatch-vuln
Closed

chore(deps): minimatch updates for security vulnerabilities#801
yamad wants to merge 1 commit into
astral-sh:mainfrom
yamad:minimatch-vuln

Conversation

@yamad

@yamad yamad commented Mar 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Our snyk scan found blocking vulnerabilities for minimatch, that are resolved by these updates.

Ran npm update minimatch, which made patch-level updates to the minimatch versions :

  • minimatch 9.0.5 -> 9.0.9
  • minimatch 31.2 -> 3.1.5

Our snyk test originally flagged the following vulnerabilities. The new versions here solve these issues:

Issues with no direct upgrade or patch:
  ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438] in minimatch@3.1.2
    introduced by @actions/glob@0.5.0 > minimatch@3.1.2 and 1 other path(s)
  This issue was fixed in versions: 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1
  ✗ Inefficient Algorithmic Complexity [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389] in minimatch@3.1.2
    introduced by @actions/glob@0.5.0 > minimatch@3.1.2 and 1 other path(s)
  This issue was fixed in versions: 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3

@yamad
yamad requested a review from eifinger as a code owner March 11, 2026 20:20
@eifinger

eifinger commented Mar 14, 2026

Copy link
Copy Markdown
Collaborator

Thank you for raising this. I looked into it an bumped the offending libraries which pulled in these as transitive dependencies in #806

@eifinger eifinger closed this Mar 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eifinger eifinger Awaiting requested review from eifinger eifinger is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yamad @eifinger