From 6f163470146841adfd0e074392ae49d680e0d401 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Sat, 14 Nov 2026 01:28:54 -0300 Subject: [PATCH] deps: minimatch 11 under vsce, out of GHSA-g3hv-75wg-m249 vsce 4.1 asks for ^10.2.6 and no 10.x has the fix. The VSIX packaged with 11.0.8 holds the same files as with 10.2.6. Co-Authored-By: Claude Opus 5.5 --- pnpm-lock.yaml | 19 ++++++++++++++----- pnpm-workspace.yaml | 6 ++++++ 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d1304b8..15c62f7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + minimatch: ^11.0.8 + importers: .: @@ -308,6 +311,9 @@ packages: cpu: [x64] os: [win32] + '@isaacs/nonrecursive-glob-match@1.1.0': + resolution: {integrity: sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==} + '@jridgewell/resolve-uri@3.1.2': resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==} engines: {node: '>=6.0.0'} @@ -1121,9 +1127,9 @@ packages: resolution: {integrity: sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==} engines: {node: '>=18'} - minimatch@10.2.6: - resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} - engines: {node: 18 || 20 || >=22} + minimatch@11.0.8: + resolution: {integrity: sha512-nFQuYSTVrGvysVBps5Ih+0BdnYFN/Cj3C816r6+p7yK+FHrVLGE4O4N9AFwykrlNlvM2HYt+Rad1Uiro6h88Ig==} + engines: {node: 20 || >=22} ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} @@ -1646,6 +1652,8 @@ snapshots: '@esbuild/win32-x64@0.28.2': optional: true + '@isaacs/nonrecursive-glob-match@1.1.0': {} + '@jridgewell/resolve-uri@3.1.2': {} '@jridgewell/sourcemap-codec@1.6.0': {} @@ -1939,7 +1947,7 @@ snapshots: jsonc-parser: 3.3.1 marked: 18.1.3 mime: 1.6.0 - minimatch: 10.2.6 + minimatch: 11.0.8 parse5: 8.1.0 proper-lockfile: 4.1.2 read: 1.0.7 @@ -2296,8 +2304,9 @@ snapshots: mimic-function@5.0.1: {} - minimatch@10.2.6: + minimatch@11.0.8: dependencies: + '@isaacs/nonrecursive-glob-match': 1.1.0 brace-expansion: 5.0.12 ms@2.1.3: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ef37eeb..648a62e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -10,3 +10,9 @@ allowBuilds: # Its postinstall picks the platform's vsce-sign binary, which signs a package for the # Marketplace: vsce package runs without it, and nothing here signs yet. '@vscode/vsce-sign': false + +overrides: + # vsce 4.1 asks for minimatch ^10.2.6, and every 10.x is in GHSA-g3hv-75wg-m249 (globParts + # amplification), fixed from 11.0.1. vsce reads only .vscodeignore's own patterns with it, and + # the VSIX it packages with 11 holds the same files. + minimatch: ^11.0.8