From 7d9c75e6eda0b8ed6dacd65f5f3727c516afeeda Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 00:26:42 +0000 Subject: [PATCH 1/2] fix(web): override minimatch to 11.x for typescript-estree Dependabot alert #32 (GHSA-g3hv-75wg-m249, minimatch >=7.0.0 <11.0.1). @typescript-eslint/typescript-estree@8.72.1 still requires ^10.2.2, so scope an npm override to that package only. The minimatch@3.1.5 copies used by eslint and eslint-plugin-react are outside the affected range and stay unchanged. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Claude --- web/package-lock.json | 18 +++++++++++++----- web/package.json | 3 +++ 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index 8cd586c84..3a09090ec 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -1936,6 +1936,13 @@ "@swc/helpers": "^0.5.0" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz", + "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==", + "dev": true, + "license": "BlueOak-1.0.0" + }, "node_modules/@jridgewell/gen-mapping": { "version": "0.3.13", "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz", @@ -7251,16 +7258,17 @@ } }, "node_modules/minimatch": { - "version": "10.2.6", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", - "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", + "version": "11.0.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz", + "integrity": "sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.8" + "@isaacs/nonrecursive-glob-match": "^1.1.0", + "brace-expansion": "^5.0.12" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" diff --git a/web/package.json b/web/package.json index 7572091f7..791bd7bef 100644 --- a/web/package.json +++ b/web/package.json @@ -85,6 +85,9 @@ "overrides": { "monaco-editor": { "dompurify": "3.4.17" + }, + "@typescript-eslint/typescript-estree": { + "minimatch": "^11.0.1" } }, "msw": { From cbb80562107757147441704f1acce42e62dd7231 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 08:35:15 +0000 Subject: [PATCH 2/2] fix(web): bump zod to 4.6.7 in lockfile GHSA-mrhx-c7xc-m3w5 (zod <4.6.6). zod is a dev-only dependency of eslint-plugin-react-hooks, which accepts ^4.0.0. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Claude --- web/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index 3a09090ec..2c6f9c0a7 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -9627,9 +9627,9 @@ } }, "node_modules/zod": { - "version": "4.4.3", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz", - "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "dev": true, "license": "MIT", "funding": {