[MelvinBot]

Details

Bumps transitive minimatch 3.1.2 → 3.1.5 (lockfile only) to fix GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74 (ReDoS).

Usage: Dev tooling only, never imported by src or shipped in dist. Pulled in by eslint and its plugins (config/file globbing), @babel/cli → glob (build file matching), and react-native → jscodeshift → node-dir.

Change Log

• 3.1.3: coalesce consecutive non-globstar * characters
• 3.1.4: limit recursion for **, improve perf
• 3.1.5: fix partial matching of globstar patterns; docs ReDoS warning

Related Issues

$ https://github.com/Expensify/Expensify/issues/695897

Manual Tests

Steps I ran on the branch:

1. npm ci, then npm ls minimatch --all shows only 3.1.5.
2. npm run lint, npm run ts, npm run build pass.
3. Timed the advisory patterns against 3.1.2 and 3.1.5: consecutive stars and repeated globstars go from over a second to instant. The nested extglob case is unchanged (no 3.x fix exists) and not reachable here.

No QA, dev-only dependency.

Linked PRs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[grgia]

@MelvinBot merged main

[grgia]

Dev-only, it's under eslint and the babel build tooling, nothing in the shipped code uses it. Lint, typecheck and build pass on the branch. No QA needed.

[grgia]

recheck

[os-botify]

🚀 Published to npm in 1.0.20 🎉