chore(cli): Upgrade minimatch to v10#127
Conversation
`@swc/cli` pins `minimatch: ^9.0.3`, which resolves `brace-expansion` v2. Every v2 release is affected by CVE-2026-14257, and the fix exists only on the v5 line, which `minimatch` picks up from v10. v10's only breaking change is the Node floor (>= 20), and `@swc/cli` already declares `node: >= 20.19.0`. The `minimatch(path, pattern)` named export used in `src/swc/sources.ts` is unchanged.
🦋 Changeset detectedLatest commit: 38b70da The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38b70da372
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| "@xhmikosr/bin-wrapper": "^14.0.0", | ||
| "commander": "^8.3.0", | ||
| "minimatch": "^9.0.3", | ||
| "minimatch": "^10.2.5", |
There was a problem hiding this comment.
When a consumer installs @swc/cli on Node 21 with strict engine validation, this dependency makes installation fail: the lockfile declares minimatch@10.2.5 supports 18 || 20 || >=22, and its brace-expansion@5.0.8 dependency supports 20 || >=22, while this package still advertises every version >=20.19.0, including Node 21. Align the package's engine range with the new dependency or choose a dependency version that supports the advertised range.
Useful? React with 👍 / 👎.
2 participants
Description
@swc/clipinsminimatch: ^9.0.3, which resolvesbrace-expansionv2. Every v2 release is affected by CVE-2026-14257 (HIGH) —expand()bounds the number of results but not their length, so ~7.5 KB of input can crash the process with a fatal, uncatchable OOM.The fix exists only on the
brace-expansionv5 line, and v5 cannot be forced ontominimatchv9: v3 movedexpandfrom a default export to a named one, andminimatch≤9 calls it as_brace_expansion.default(pattern). So consumers cannot resolve this with an override —minimatchv10 is the first release that picks up the patched line, which makes this bump the only route.@swc/clicurrently sits at the end of that chain for anyone whose scanner walks the lockfile. It's the last package in my dependency graph still holdingbrace-expansionv2;@electron/universalandfilelisthave already moved.Why v10 is safe here
Per minimatch's changelog, v10.0's only breaking change is
Require node 20 or 22 and higher.packages/cli/package.jsonalready declares"node": ">= 20.19.0", so the floor is satisfied.The API surface used in
src/swc/sources.tsis theminimatch(path, pattern)named export, unchanged since v9 (v9.0 was the release that dropped the default export). No source changes are needed.Verification
Note that the existing suite does not cover the
--only/--ignorecode paths that callminimatch, so a green run alone doesn't prove much here. I checked the behaviour directly as well:pnpm testinpackages/cli— 6 suites, 37 tests, all pass (identical to the pre-change baseline)pnpm types(tsc) — cleanswc --only/--ignoreusage — globstars, brace sets, extglobs (!(...),@(...),+(...),?(...)), dotfiles,node_modulesexcludes — 0 behavioural differencesminimatch@10.2.5→brace-expansion@5.0.8(patched)Lockfile delta is 28 lines and purely additive (
minimatch@10.2.5,brace-expansion@5.0.8,balanced-match@4.0.4).Note
The one-line whitespace change at the end of
packages/cli/package.json(adding the missing trailing newline) was made automatically by the repo's ownlint-staged+ prettier pre-commit hook, not by hand. Happy to strip it if you'd rather keep the diff to a single line.A changeset is included (
patchfor@swc/cli).