[GHSA-3ppc-4f35-3m26] minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern#7002
Conversation
|
Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
github-actions
bot
changed the base branch from
main
to
G-Rath/advisory-improvement-7002
There was a problem hiding this comment.
Pull request overview
Updates the GitHub-reviewed advisory record for GHSA-3ppc-4f35-3m26 to match the upstream minimatch advisory by refining affected version ranges and adding an additional reference.
Changes:
- Refined affected version range start for v10 and added explicit affected ranges for v3–v9.
- Added a new web reference link to the related upstream issue.
- Bumped the advisory
modifiedtimestamp.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "minimatch" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "9.0.0" | ||
| }, | ||
| { | ||
| "fixed": "9.0.6" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "minimatch" | ||
| }, | ||
| "ranges": [ |
There was a problem hiding this comment.
Multiple affected entries repeat the same { ecosystem: "npm", name: "minimatch" } package block, which increases duplication and makes future edits error-prone. Consider consolidating these into a single affected item for minimatch with multiple ranges entries so all version windows live under one package record.
|
All validations completed successfully.
This PR is ready for immediate merge. |
3 participants
Updates
Comments
Updated to match GHSA-3ppc-4f35-3m26