[mzitsolutions]

Updates

• Affected products

Comments
The current affected range (< 11.0.1) appears to be overly broad for the specific globparts amplification vulnerability described in this advisory.

Inspection of the published minimatch npm packages indicates that versions 3.1.5, 4.2.3, 4.2.6, 5.1.6 and 6.2.0 do not contain the relevant firstPhasePreProcess(), secondPhasePreProcess() and **/../ transformation logic.

The relevant preprocessing implementation appears starting in version 7.0.0. In versions 7.0.0 and 7.0.1, both phases execute unconditionally; from version 7.1.0 onward, execution depends on optimizationLevel >= 2.

I therefore propose narrowing the affected range for this specific vulnerability to >= 7.0.0, < 11.0.1.

This proposal concerns only the vulnerability described in GHSA-g3hv-75wg-m249 and does not assert that older minimatch releases are free from other vulnerabilities. Please review the version boundary against the published source code.

[github]

Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[shelbyc]

Closed as a duplicate of #10807