Skip to content

chore(deps): add pnpm override to remove minimatch@3.1.5 from lock file#1507

Merged
taymoor89 merged 1 commit intomainfrom
taimoor_add_glob_override_minimatch
Mar 5, 2026
Merged

chore(deps): add pnpm override to remove minimatch@3.1.5 from lock file#1507
taymoor89 merged 1 commit intomainfrom
taimoor_add_glob_override_minimatch

Conversation

@taymoor89
Copy link
Contributor

Summary

Adds pnpm overrides to force safe minimatch versions, completely removing vulnerable minimatch@3.1.5 from pnpm-lock.yaml.

Changes Made

  • Added glob>minimatch: ">=10.2.4" override to force safe version for glob@7.2.3 dependency
  • Verified only safe minimatch versions remain (9.0.9 and 10.2.4)

Related Issues

Screenshots (if applicable)

Testing Instructions

  1. pnpm i
  2. grep "minimatch@3" pnpm-lock.yaml - Should return nothing
  3. pnpm why minimatch - Should show only 9.0.9 and 10.2.4

Checklist

  • I have performed a self-review of my code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have added tests that prove my fix is effective or that my feature works.
  • New and existing unit tests pass locally with my changes.
  • I have made corresponding changes to the documentation (if applicable).
  • My changes generate no new warnings or errors.
  • I have created a changeset for my changes.

PR Manifesto

Review the PR Manifesto for best practises.

@taymoor89 taymoor89 requested a review from a team as a code owner March 4, 2026 15:20
@changeset-bot
Copy link

changeset-bot bot commented Mar 4, 2026

⚠️ No Changeset found

Latest commit: 02127b3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@taymoor89 taymoor89 self-assigned this Mar 4, 2026
Copy link
Contributor

@guoda-puidokaite guoda-puidokaite left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank You! 🌸

@taymoor89 taymoor89 merged commit 38dcf01 into main Mar 5, 2026
16 checks passed
@taymoor89 taymoor89 deleted the taimoor_add_glob_override_minimatch branch March 5, 2026 08:08
@guoda-puidokaite guoda-puidokaite linked an issue Mar 6, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Task](juno): Fix high and medium vulnerabilities

3 participants