[MelvinBot]

Details

Bumps transitive minimatch to patched versions, fixing open ReDoS Dependabot alerts (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26):

• 3.1.2 → 3.1.5
• 5.1.6 → 5.1.9
• 8.0.4 → 8.0.7
• 9.0.3 → 9.0.9: @typescript-eslint/typescript-estree@6.21.0 (via eslint-plugin-deprecation) pins 9.0.3 exactly, so a scoped overrides entry (minimatch@9.0.3 → ^9.0.7) dedupes it to the existing root 9.0.9.

Usage: not imported by the library. Only dev/build tooling uses it for glob matching: ESLint and its plugins, react-native-builder-bob (build), patch-package, nodemon, Jest coverage (test-exclude), and babel-plugin-module-resolver in example/.

Change Log

• 3.1.3 / 5.1.7 / 8.0.5 / 9.0.6: coalesce consecutive non-globstar * (ReDoS fix)
• 3.1.4 / 5.1.8: limit recursion for **, big perf improvement (ReDoS fix)
• 8.0.6 / 9.0.7: limit nested extglob recursion, flatten extglobs (ReDoS fix)
• 3.1.5 / 5.1.9 / 8.0.7 / 9.0.8: fix partial matching of globstar patterns; docs ReDoS warning
• 9.0.4: fastTest set as a property on the regex object; build with tshy
• 9.0.5: fix duplicated patterns in second-phase preprocess loop
• 9.0.9: depend on brace-expansion@2

Related Issues

$ https://github.com/Expensify/Expensify/issues/695658

Manual Tests

1. npm ci, then npm ls minimatch --all: no minimatch below 3.1.5, 5.1.9, 8.0.7, or 9.0.9.
2. npm run lint, npm run typecheck, and npm test pass.
3. npm run prepare builds lib/ without errors.
4. Start the example app on iOS and Android. Confirm Metro bundles and the markdown input renders and formats text.

Steps 1–3 pass locally.

Linked PRs

None.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[blimpich]

I have read the CLA Document and I hereby sign the CLA

[blimpich]

– written by Claude on Ben's behalf

[stitesExpensify]

RIP, conflicts

[os-botify]

🚀 Published to npm in 0.1.358 🎉