From 8bac0358627e2c8f83502ff8e471bcba0f81ae33 Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Sun, 26 Jul 2026 10:16:26 +0200 Subject: [PATCH 1/3] chore(security): pin remaining vulnerable transitive deps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Behebt die Dependabot-Alerts, für die es keinen eigenen PR gab, über yarn resolutions: - brace-expansion 1.1.13 -> 1.1.16 (via minimatch) - qs 6.14.2 -> 6.15.3 (via express) - uuid 8.3.2 -> 11.1.1 (via sockjs) - ws 7.5.10 -> 7.5.13 (via webpack-bundle-analyzer) - ws 8.20.0 -> 8.21.1 (via webpack-dev-server) Geprüft mit yarn typecheck, yarn build und einem sockjs-Smoketest. Geänderte Dateien: - package.json - yarn.lock --- package.json | 7 ++++++- yarn.lock | 54 ++++++++++++++++++---------------------------------- 2 files changed, 24 insertions(+), 37 deletions(-) diff --git a/package.json b/package.json index fbe4f97..4330833 100644 --- a/package.json +++ b/package.json @@ -40,7 +40,12 @@ "postcss": "^8.5.10", "serialize-javascript": "^7.0.5", "follow-redirects": "^1.16.0", - "@babel/plugin-transform-modules-systemjs": "^7.29.4" + "@babel/plugin-transform-modules-systemjs": "^7.29.4", + "brace-expansion": "^1.1.16", + "qs": "^6.15.3", + "**/sockjs/uuid": "^11.1.1", + "**/webpack-bundle-analyzer/ws": "^7.5.11", + "**/webpack-dev-server/ws": "^8.21.0" }, "browserslist": { "production": [ diff --git a/yarn.lock b/yarn.lock index e3a2979..73f23fc 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3901,10 +3901,10 @@ boxen@^7.0.0: widest-line "^4.0.1" wrap-ansi "^8.1.0" -brace-expansion@^1.1.7: - version "1.1.13" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.13.tgz#d37875c01dc9eff988dd49d112a57cb67b54efe6" - integrity sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w== +brace-expansion@^1.1.16, brace-expansion@^1.1.7: + version "1.1.16" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.16.tgz#723d3a30c0558c225abc9fc479a73e14e26c3c2f" + integrity sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw== dependencies: balanced-match "^1.0.0" concat-map "0.0.1" @@ -8358,14 +8358,7 @@ pvutils@^1.1.3: resolved "https://registry.yarnpkg.com/pvutils/-/pvutils-1.1.5.tgz#84b0dea4a5d670249aa9800511804ee0b7c2809c" integrity sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA== -qs@~6.14.0: - version "6.14.2" - resolved "https://registry.yarnpkg.com/qs/-/qs-6.14.2.tgz#b5634cf9d9ad9898e31fba3504e866e8efb6798c" - integrity sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q== - dependencies: - side-channel "^1.1.0" - -qs@~6.15.1: +qs@^6.15.3, qs@~6.14.0, qs@~6.15.1: version "6.15.3" resolved "https://registry.yarnpkg.com/qs/-/qs-6.15.3.tgz#76852132a58ed5c7c0ef67e4441b9bb5d6061b3b" integrity sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A== @@ -9023,7 +9016,7 @@ shell-quote@^1.8.4: resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.10.0.tgz#482033e192e4f5c07151521ffa03400ec71b1b0f" integrity sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA== -side-channel-list@^1.0.0, side-channel-list@^1.0.1: +side-channel-list@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/side-channel-list/-/side-channel-list-1.0.1.tgz#c2e0b5a14a540aebee3bbc6c3f8666cc9b509127" integrity sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w== @@ -9052,17 +9045,6 @@ side-channel-weakmap@^1.0.2: object-inspect "^1.13.3" side-channel-map "^1.0.1" -side-channel@^1.1.0: - version "1.1.0" - resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.0.tgz#c3fcff9c4da932784873335ec9765fa94ff66bc9" - integrity sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw== - dependencies: - es-errors "^1.3.0" - object-inspect "^1.13.3" - side-channel-list "^1.0.0" - side-channel-map "^1.0.1" - side-channel-weakmap "^1.0.2" - side-channel@^1.1.1: version "1.1.1" resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.1.tgz#ea02c62e05dc4bea67d4442f0fb71ee192f8e0ab" @@ -9729,10 +9711,10 @@ utils-merge@1.0.1: resolved "https://registry.yarnpkg.com/utils-merge/-/utils-merge-1.0.1.tgz#9f95710f50a267947b2ccc124741c1028427e713" integrity sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA== -uuid@^8.3.2: - version "8.3.2" - resolved "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2" - integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg== +uuid@^11.1.1, uuid@^8.3.2: + version "11.1.1" + resolved "https://registry.yarnpkg.com/uuid/-/uuid-11.1.1.tgz#f6d81d2e1c65d00762e5e29b16c5d2d995e208ad" + integrity sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ== value-equal@^1.0.1: version "1.0.1" @@ -10003,15 +9985,15 @@ write-file-atomic@^3.0.3: signal-exit "^3.0.2" typedarray-to-buffer "^3.1.5" -ws@^7.3.1: - version "7.5.10" - resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.10.tgz#58b5c20dc281633f6c19113f39b349bd8bd558d9" - integrity sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ== +ws@^7.3.1, ws@^7.5.11: + version "7.5.13" + resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.13.tgz#12aa507eaca76c295c278b1aebf4698ab2c1845f" + integrity sha512-rsKI6xDBFVf4r/x8XyChGK04QR/XHroxs/jUcoWvtEZM8TPU/X/uIY9B1CsSzYws9ZJb/6bbBu7dPhFW00CAoA== -ws@^8.18.0: - version "8.20.0" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.20.0.tgz#4cd9532358eba60bc863aad1623dfb045a4d4af8" - integrity sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA== +ws@^8.18.0, ws@^8.21.0: + version "8.21.1" + resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.1.tgz#045650cd4b1207809e7547146223c3814a9af586" + integrity sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw== wsl-utils@^0.1.0: version "0.1.0" From f50fbf72cc254591066ab70441bb3612c0a924b7 Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Sun, 26 Jul 2026 10:31:05 +0200 Subject: [PATCH 2/3] chore(security): route brace-expansion through patched implementation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHSA-mh99-v99m-4gvg ist nur in brace-expansion 5.0.8 behoben, für die 1.x-Linie gibt es keinen Fix. Ein direkter Bump auf 5.x geht nicht, weil der CommonJS-Build dort ein Objekt statt einer Funktion exportiert und minimatch@3 (via serve-handler und docusaurus-lunr-search) genau diese callable API braucht. Deshalb ein kleiner lokaler Compat-Shim: brace-expansion wird per resolutions auf patches/brace-expansion-compat gemappt, der intern @isaacs/brace-expansion 5.0.1 nutzt (gleicher Fix, GHSA-7h2j-956f-4vf2 dort ab 5.0.1 behoben) und ihn unter der alten callable Signatur weiterreicht. Damit ist brace-expansion 1.x komplett aus dem Baum raus und das Expansion-Limit von 100000 greift. Geprüft mit yarn typecheck, yarn build inklusive lunr-Indexierung und einem serve-handler-Smoketest gegen den gebauten Output. Geänderte Dateien: - package.json - yarn.lock - patches/brace-expansion-compat/package.json (neu) - patches/brace-expansion-compat/index.js (neu) --- package.json | 2 +- patches/brace-expansion-compat/index.js | 19 +++++++++++++ patches/brace-expansion-compat/package.json | 13 +++++++++ yarn.lock | 31 ++++++++++----------- 4 files changed, 48 insertions(+), 17 deletions(-) create mode 100644 patches/brace-expansion-compat/index.js create mode 100644 patches/brace-expansion-compat/package.json diff --git a/package.json b/package.json index 4330833..2aa1170 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "serialize-javascript": "^7.0.5", "follow-redirects": "^1.16.0", "@babel/plugin-transform-modules-systemjs": "^7.29.4", - "brace-expansion": "^1.1.16", + "brace-expansion": "file:./patches/brace-expansion-compat", "qs": "^6.15.3", "**/sockjs/uuid": "^11.1.1", "**/webpack-bundle-analyzer/ws": "^7.5.11", diff --git a/patches/brace-expansion-compat/index.js b/patches/brace-expansion-compat/index.js new file mode 100644 index 0000000..49c9fc7 --- /dev/null +++ b/patches/brace-expansion-compat/index.js @@ -0,0 +1,19 @@ +'use strict'; + +// brace-expansion 1.x exports the expand function directly: +// var expand = require('brace-expansion'); expand('a{b,c}d') +// That is how minimatch@3 calls it, and minimatch@3 is still pulled in by +// serve-handler and docusaurus-lunr-search. +// +// The DoS advisory GHSA-mh99-v99m-4gvg is only fixed in brace-expansion 5.0.8, +// whose CommonJS build exports an object ({ expand, EXPANSION_MAX, ... }) instead +// of a callable, so it cannot be dropped in for minimatch@3. Same story for the +// scoped fork @isaacs/brace-expansion, which carries the same fix and is what +// minimatch 10 uses. +// +// This shim bridges the two: patched implementation, old callable signature. + +const { expand } = require('@isaacs/brace-expansion'); + +module.exports = expand; +module.exports.expand = expand; diff --git a/patches/brace-expansion-compat/package.json b/patches/brace-expansion-compat/package.json new file mode 100644 index 0000000..7ff687a --- /dev/null +++ b/patches/brace-expansion-compat/package.json @@ -0,0 +1,13 @@ +{ + "name": "brace-expansion-compat", + "version": "1.1.17", + "description": "CommonJS compat shim: exposes the patched @isaacs/brace-expansion implementation under the callable brace-expansion@1.x API used by minimatch@3.", + "license": "MIT", + "main": "index.js", + "files": [ + "index.js" + ], + "dependencies": { + "@isaacs/brace-expansion": "^5.0.1" + } +} diff --git a/yarn.lock b/yarn.lock index 73f23fc..2aa1749 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2151,6 +2151,18 @@ dependencies: "@hapi/hoek" "^9.0.0" +"@isaacs/balanced-match@^4.0.1": + version "4.0.1" + resolved "https://registry.yarnpkg.com/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz#3081dadbc3460661b751e7591d7faea5df39dd29" + integrity sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ== + +"@isaacs/brace-expansion@^5.0.1": + version "5.0.1" + resolved "https://registry.yarnpkg.com/@isaacs/brace-expansion/-/brace-expansion-5.0.1.tgz#0ef5a92d91f2fff2a37646ce54da9e5f599f6eff" + integrity sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ== + dependencies: + "@isaacs/balanced-match" "^4.0.1" + "@jest/schemas@^29.6.3": version "29.6.3" resolved "https://registry.yarnpkg.com/@jest/schemas/-/schemas-29.6.3.tgz#430b5ce8a4e0044a7e3819663305a7b3091c8e03" @@ -3812,11 +3824,6 @@ bail@^2.0.0: resolved "https://registry.yarnpkg.com/bail/-/bail-2.0.2.tgz#d26f5cd8fe5d6f832a31517b9f7c356040ba6d5d" integrity sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw== -balanced-match@^1.0.0: - version "1.0.2" - resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee" - integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw== - baseline-browser-mapping@^2.10.12: version "2.10.17" resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.17.tgz#435c101835c314c2d89d768795e1ea79941fafd3" @@ -3901,13 +3908,10 @@ boxen@^7.0.0: widest-line "^4.0.1" wrap-ansi "^8.1.0" -brace-expansion@^1.1.16, brace-expansion@^1.1.7: - version "1.1.16" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.16.tgz#723d3a30c0558c225abc9fc479a73e14e26c3c2f" - integrity sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw== +brace-expansion@^1.1.7, "brace-expansion@file:./patches/brace-expansion-compat": + version "1.1.17" dependencies: - balanced-match "^1.0.0" - concat-map "0.0.1" + "@isaacs/brace-expansion" "^5.0.1" braces@^3.0.3, braces@~3.0.2: version "3.0.3" @@ -4266,11 +4270,6 @@ compression@^1.8.1: safe-buffer "5.2.1" vary "~1.1.2" -concat-map@0.0.1: - version "0.0.1" - resolved "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b" - integrity sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg== - config-chain@^1.1.11: version "1.1.13" resolved "https://registry.yarnpkg.com/config-chain/-/config-chain-1.1.13.tgz#fad0795aa6a6cdaff9ed1b68e9dff94372c232f4" From b0a3bb41df7e2cde74757573c3d9b680b4340d31 Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Sun, 26 Jul 2026 10:37:23 +0200 Subject: [PATCH 3/3] chore(security): shim minimatch instead of brace-expansion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Der vorherige Ansatz hat brace-expansion selbst ersetzt. Das funktioniert zwar technisch, der Dependency-Review-Scan sieht das Paket aber weiterhin als brace-expansion 1.x und schlägt an. Die Version künstlich über 5.0.7 zu heben wäre nur Kosmetik gegenüber dem Scanner. Stattdessen jetzt an der richtigen Stelle angesetzt: minimatch wird per resolutions auf einen Shim gemappt, der minimatch 10 unter der callable minimatch@3 API bereitstellt. minimatch 10 hängt selbst schon an brace-expansion ^5.0.5, damit löst brace-expansion regulär auf 5.0.8 auf und die verwundbare 1.x-Linie ist komplett aus dem Baum. Nichts wird maskiert, das Paket ist echt gepatcht. Beide Consumer (serve-handler, docusaurus-lunr-search) rufen minimatch ausschließlich als Funktion auf. Ein A/B-Vergleich gegen echtes minimatch 3.1.5 über neun Glob-, Globstar- und Brace-Patterns liefert identische Ergebnisse. Geprüft mit yarn typecheck, yarn build inklusive lunr-Indexierung (unverändert 37 Dokumente) und einem serve-handler-Smoketest, bei dem das Header-Glob-Matching über minimatch tatsächlich greift. Geänderte Dateien: - package.json - yarn.lock - patches/minimatch-compat/package.json (neu) - patches/minimatch-compat/index.js (neu) - patches/brace-expansion-compat/ (entfernt) --- package.json | 2 +- patches/brace-expansion-compat/index.js | 19 ---------- patches/brace-expansion-compat/package.json | 13 ------- patches/minimatch-compat/index.js | 36 +++++++++++++++++++ patches/minimatch-compat/package.json | 16 +++++++++ yarn.lock | 40 ++++++++++----------- 6 files changed, 73 insertions(+), 53 deletions(-) delete mode 100644 patches/brace-expansion-compat/index.js delete mode 100644 patches/brace-expansion-compat/package.json create mode 100644 patches/minimatch-compat/index.js create mode 100644 patches/minimatch-compat/package.json diff --git a/package.json b/package.json index 2aa1170..69b1334 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "serialize-javascript": "^7.0.5", "follow-redirects": "^1.16.0", "@babel/plugin-transform-modules-systemjs": "^7.29.4", - "brace-expansion": "file:./patches/brace-expansion-compat", + "minimatch": "file:./patches/minimatch-compat", "qs": "^6.15.3", "**/sockjs/uuid": "^11.1.1", "**/webpack-bundle-analyzer/ws": "^7.5.11", diff --git a/patches/brace-expansion-compat/index.js b/patches/brace-expansion-compat/index.js deleted file mode 100644 index 49c9fc7..0000000 --- a/patches/brace-expansion-compat/index.js +++ /dev/null @@ -1,19 +0,0 @@ -'use strict'; - -// brace-expansion 1.x exports the expand function directly: -// var expand = require('brace-expansion'); expand('a{b,c}d') -// That is how minimatch@3 calls it, and minimatch@3 is still pulled in by -// serve-handler and docusaurus-lunr-search. -// -// The DoS advisory GHSA-mh99-v99m-4gvg is only fixed in brace-expansion 5.0.8, -// whose CommonJS build exports an object ({ expand, EXPANSION_MAX, ... }) instead -// of a callable, so it cannot be dropped in for minimatch@3. Same story for the -// scoped fork @isaacs/brace-expansion, which carries the same fix and is what -// minimatch 10 uses. -// -// This shim bridges the two: patched implementation, old callable signature. - -const { expand } = require('@isaacs/brace-expansion'); - -module.exports = expand; -module.exports.expand = expand; diff --git a/patches/brace-expansion-compat/package.json b/patches/brace-expansion-compat/package.json deleted file mode 100644 index 7ff687a..0000000 --- a/patches/brace-expansion-compat/package.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "name": "brace-expansion-compat", - "version": "1.1.17", - "description": "CommonJS compat shim: exposes the patched @isaacs/brace-expansion implementation under the callable brace-expansion@1.x API used by minimatch@3.", - "license": "MIT", - "main": "index.js", - "files": [ - "index.js" - ], - "dependencies": { - "@isaacs/brace-expansion": "^5.0.1" - } -} diff --git a/patches/minimatch-compat/index.js b/patches/minimatch-compat/index.js new file mode 100644 index 0000000..b95ea51 --- /dev/null +++ b/patches/minimatch-compat/index.js @@ -0,0 +1,36 @@ +'use strict'; + +// Why this exists: +// +// brace-expansion 1.x is affected by GHSA-mh99-v99m-4gvg (unbounded expansion, +// OOM crash) and the 1.x line never got a patch. The fix only landed in 5.0.8. +// The only thing still pulling brace-expansion 1.x is minimatch@3, which +// serve-handler and docusaurus-lunr-search depend on. +// +// brace-expansion 5 cannot be dropped into minimatch@3 because its CommonJS +// build exports an object instead of a callable. Going the other way works +// though: minimatch 10 already depends on the patched brace-expansion 5.x. Its +// own CommonJS build is not callable either, but that is easy to bridge, and +// unlike brace-expansion the API surface here is small and stable. +// +// So this shim is mapped over "minimatch" via yarn resolutions. Result: +// minimatch@3 is gone, brace-expansion resolves to a patched 5.x, and the two +// consumers keep the callable signature they expect. + +const mm = require('minimatch-modern'); + +const minimatch = mm.minimatch; + +// minimatch@3 hangs its extras off the exported function (Minimatch, filter, +// match, makeRe, braceExpand, defaults, sep, GLOBSTAR). Carry them over so the +// shim is shaped like the module it replaces. +for (const key of Object.keys(mm)) { + if (key === 'minimatch') continue; + try { + minimatch[key] = mm[key]; + } catch (err) { + // read-only function properties (name, length) are not overwritable + } +} + +module.exports = minimatch; diff --git a/patches/minimatch-compat/package.json b/patches/minimatch-compat/package.json new file mode 100644 index 0000000..1847206 --- /dev/null +++ b/patches/minimatch-compat/package.json @@ -0,0 +1,16 @@ +{ + "name": "minimatch-compat", + "version": "3.1.6", + "description": "CommonJS compat shim: serves minimatch 10 under the callable minimatch@3 API, so the tree can drop the unpatchable brace-expansion 1.x.", + "license": "ISC", + "main": "index.js", + "files": [ + "index.js" + ], + "dependencies": { + "minimatch-modern": "npm:minimatch@^10.2.5" + }, + "engines": { + "node": ">=20.0" + } +} diff --git a/yarn.lock b/yarn.lock index 2aa1749..6d79a0e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2151,18 +2151,6 @@ dependencies: "@hapi/hoek" "^9.0.0" -"@isaacs/balanced-match@^4.0.1": - version "4.0.1" - resolved "https://registry.yarnpkg.com/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz#3081dadbc3460661b751e7591d7faea5df39dd29" - integrity sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ== - -"@isaacs/brace-expansion@^5.0.1": - version "5.0.1" - resolved "https://registry.yarnpkg.com/@isaacs/brace-expansion/-/brace-expansion-5.0.1.tgz#0ef5a92d91f2fff2a37646ce54da9e5f599f6eff" - integrity sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ== - dependencies: - "@isaacs/balanced-match" "^4.0.1" - "@jest/schemas@^29.6.3": version "29.6.3" resolved "https://registry.yarnpkg.com/@jest/schemas/-/schemas-29.6.3.tgz#430b5ce8a4e0044a7e3819663305a7b3091c8e03" @@ -3824,6 +3812,11 @@ bail@^2.0.0: resolved "https://registry.yarnpkg.com/bail/-/bail-2.0.2.tgz#d26f5cd8fe5d6f832a31517b9f7c356040ba6d5d" integrity sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw== +balanced-match@^4.0.2: + version "4.0.4" + resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-4.0.4.tgz#bfb10662feed8196a2c62e7c68e17720c274179a" + integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA== + baseline-browser-mapping@^2.10.12: version "2.10.17" resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.17.tgz#435c101835c314c2d89d768795e1ea79941fafd3" @@ -3908,10 +3901,12 @@ boxen@^7.0.0: widest-line "^4.0.1" wrap-ansi "^8.1.0" -brace-expansion@^1.1.7, "brace-expansion@file:./patches/brace-expansion-compat": - version "1.1.17" +brace-expansion@^5.0.5: + version "5.0.8" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.8.tgz#135ad0d8d808eb18eb5e0ec9a21f3a0b92ef18cf" + integrity sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg== dependencies: - "@isaacs/brace-expansion" "^5.0.1" + balanced-match "^4.0.2" braces@^3.0.3, braces@~3.0.2: version "3.0.3" @@ -7277,12 +7272,17 @@ minimalistic-assert@^1.0.0: resolved "https://registry.yarnpkg.com/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz#2e194de044626d4a10e7f7fbc00ce73e83e4d5c7" integrity sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A== -minimatch@3.1.5, minimatch@^3.1.2: - version "3.1.5" - resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.5.tgz#580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e" - integrity sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w== +"minimatch-modern@npm:minimatch@^10.2.5": + version "10.2.5" + resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.5.tgz#bd48687a0be38ed2961399105600f832095861d1" + integrity sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg== + dependencies: + brace-expansion "^5.0.5" + +minimatch@3.1.5, minimatch@^3.1.2, "minimatch@file:./patches/minimatch-compat": + version "3.1.6" dependencies: - brace-expansion "^1.1.7" + minimatch-modern "npm:minimatch@^10.2.5" minimist@^1.2.0: version "1.2.8"