chore!: updating minimatch by isaacs · Pull Request #885 · getsentry/sentry-javascript-bundler-plugins

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

    "dotenv": "^16.3.1",
    "find-up": "^5.0.0",
-    "glob": "^10.5.0",
+    "glob": "^13.0.6",


Node version mismatch with glob dependency

High Severity

The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs force-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 9c89009 to f1d3304 Compare February 19, 2026 18:20

isaacs mentioned this pull request Feb 19, 2026

chore: updating minimatch getsentry/sentry-javascript#19434

Merged

3 tasks

isaacs force-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from f1d3304 to 3d46820 Compare February 20, 2026 17:00

isaacs marked this pull request as ready for review February 20, 2026 17:00

sentry Bot reviewed Feb 23, 2026

View reviewed changes

Comment thread packages/bundler-plugin-core/package.json Resolved

cursor Bot reviewed Feb 23, 2026

View reviewed changes

andreiborza changed the title ~~chore: updating minimatch~~ chore!: updating minimatch Feb 23, 2026

andreiborza added the Meta: Breaking label Feb 23, 2026

isaacs and others added 2 commits February 23, 2026 12:03

Bump balanced-match in lockfile to 4.0.4

6b2327a

andreiborza force-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 5bb07e0 to 6b2327a Compare February 23, 2026 11:03

andreiborza added 2 commits February 23, 2026 12:14

Bump minimatch v3 and v5 usages

7cf8cd0

Bump minimatch and brace-expansion in lockfile to patched versions

5f05b54

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza approved these changes Feb 23, 2026

View reviewed changes

chargome approved these changes Feb 23, 2026

View reviewed changes

andreiborza merged commit 8781545 into main Feb 23, 2026
34 of 36 checks passed

andreiborza deleted the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch February 23, 2026 11:43

sentry-release-bot Bot mentioned this pull request Feb 23, 2026

publish: getsentry/sentry-javascript-bundler-plugins@5.0.0 getsentry/publish#7238

Closed

7 tasks

Navigation Menu

Repository navigation

chore!: updating minimatch - #885

chore!: updating minimatch#885
andreiborza merged 4 commits into
mainfrom
isaacschlueter/js-1765-vulnerable-dependency-minimatch

isaacs commented Feb 19, 2026

Uh oh!

linear Bot commented Feb 19, 2026

Uh oh!

github-actions Bot commented Feb 19, 2026 •

edited

Loading

Breaking Changes 🛠

Bug Fixes 🐛

Internal Changes 🔧

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Feb 23, 2026

Uh oh!

andreiborza commented Feb 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

isaacs commented Feb 19, 2026

Uh oh!

linear Bot commented Feb 19, 2026

Uh oh!

github-actions Bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Breaking Changes 🛠

Bug Fixes 🐛

Internal Changes 🔧

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Feb 23, 2026

Choose a reason for hiding this comment

Node version mismatch with glob dependency

Uh oh!

andreiborza commented Feb 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Feb 19, 2026 •

edited

Loading