You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(web): override minimatch to 11.x and bump zod to 4.6.7 - #858
The only affected copy is minimatch 10.2.6, which @typescript-eslint/typescript-estree@8.72.1 pulls in through ^10.2.2. Its latest and canary versions still require ^10.2.2, so Dependabot can't update it.
This PR adds a scoped override, "@typescript-eslint/typescript-estree": { "minimatch": "^11.0.1" }, which resolves to 11.0.5. It follows the same pattern as the dompurify override from fix(web): pin monaco-editor's dompurify to 3.4.17 #794.
The minimatch@3.1.5 copies under eslint, @eslint/* and eslint-plugin-react fall outside the affected range and stay as they are.
typescript-estree calls only minimatch(filePath, pattern, { dot: true }), and only for projectService.allowDefaultProject. That export and signature are unchanged in 11.x. Our ESLint config uses project: "./tsconfig.json", so that code path never runs, which means the alert can't be exploited here.
Updated internal package configuration as part of routine maintenance. This update does not add or remove user-facing functionality, and it does not change the app’s visible behavior. Existing screens and workflows remain unchanged, so no action is needed to continue using the app as before.
Dependabot alert #32 (GHSA-g3hv-75wg-m249, minimatch >=7.0.0 <11.0.1).
@typescript-eslint/typescript-estree@8.72.1 still requires ^10.2.2, so
scope an npm override to that package only. The minimatch@3.1.5 copies
used by eslint and eslint-plugin-react are outside the affected range
and stay unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
GHSA-mrhx-c7xc-m3w5 (zod <4.6.6). zod is a dev-only dependency of
eslint-plugin-react-hooks, which accepts ^4.0.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
Suggested labels: type: fix, type: security, area: web
Merge Risk: Minimal · up to cbb80
No merge-blocking issue is identified; run the normal lint and test checks before merging.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the two changes in the PR: the minimatch override to 11.x and the zod bump to 4.6.7. The raw summary only describes the package.json minimatch override and does not mention zod. The PR…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the two changes in the PR: the minimatch override to 11.x and the zod bump to 4.6.7. The raw summary only describes the package.json minimatch override and does not mention zod. The PR objectives confirm the zod update from 4.4.3 to 4.6.7 in package-lock.json. The title is accurate and specific, but the zod part cannot be checked against the visible diff because package-lock.json is excluded from review. The title uses the fix(web) conventional-commit format and stays under 72 characters.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Reviewing files that changed from the base of the PR and between 4f5f5aa and cbb8056.
Files ignored due to path filters: 1
web/package-lock.json is excluded by !**/package-lock.json
Files selected for processing: 1
web/package.json
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ValgulNecron
added
type: security
Claude
Summary
Fixes two dev-only npm advisories in
web/package-lock.json.minimatch: Dependabot alert #32 (GHSA-g3hv-75wg-m249,
>=7.0.0 <11.0.1)@typescript-eslint/typescript-estree@8.72.1pulls in through^10.2.2. Its latest and canary versions still require^10.2.2, so Dependabot can't update it."@typescript-eslint/typescript-estree": { "minimatch": "^11.0.1" }, which resolves to 11.0.5. It follows the same pattern as the dompurify override from fix(web): pin monaco-editor's dompurify to 3.4.17 #794.minimatch@3.1.5copies under eslint,@eslint/*and eslint-plugin-react fall outside the affected range and stay as they are.minimatch(filePath, pattern, { dot: true }), and only forprojectService.allowDefaultProject. That export and signature are unchanged in 11.x. Our ESLint config usesproject: "./tsconfig.json", so that code path never runs, which means the alert can't be exploited here.20 || >=22. CI runs Node 24.zod: GHSA-mrhx-c7xc-m3w5 (
<4.6.6)^4.0.0.Verification
@isaacs/nonrecursive-glob-matchdependency and zod.npm audit --package-lock-onlyreports 0 vulnerabilities.npm ls minimatchshows the override applies only under typescript-estree.npx tsc --noEmitpasses. Lint and tests are left to CI.🤖 Generated with Claude Code
Summary by CodeRabbit