feat: upgrade minimatch to v10.0.3#5291
Merged
dmichon-msft merged 5 commits intomicrosoft:mainfrom Jul 31, 2025
Merged
Conversation
- Update minimatch dependency from ~3.0.3 to 10.0.3 across monorepo
- Update @types/minimatch from 3.0.5 to 6.0.0
- Fix breaking API changes: switch from default import to named import
- api-extractor: `import minimatch from 'minimatch'` → `import { minimatch } from 'minimatch'`
- webpack4-localization-plugin: same import pattern update
- Centralize version management via common-versions.json preferredVersions
- Update lock files and repo state hashes for both subspaces
Breaking change: minimatch v10 uses named exports instead of default export
robdefeo
requested review from
D4N14L,
apostolisms,
dmichon-msft,
iclanton and
octogonz
as code owners
Contributor
Author
@microsoft-github-policy-service agree company="Vidos Ltd" |
Contributor
Author
@microsoft-github-policy-service agree company="Vidos Ltd" |
Contributor
dmichon-msft
left a comment
dmichon-msft
left a comment
There was a problem hiding this comment.
We don't need @types/minimatch at all anymore, but otherwise this looks fine.
- minimatch v10 renamed IMinimatch interface to Minimatch class - Update type annotations to use the new class name
dmichon-msft
approved these changes
Jul 31, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR upgrades the minimatch dependency from ~3.0.3 to 10.0.3 across the entire Rush monorepo to address a Regular Expression Denial of Service (ReDoS) vulnerability in the underlying brace-expansion dependency.
🔒 Security Issue
Vulnerability: GHSA-v6h2-p8h4-qcjw - CVE-2025-5889
Severity: Low (CVSS 1.3/10)
Impact: ReDoS vulnerability in brace-expansion dependency used by older versions of minimatch
The vulnerability affects the brace-expansion package versions:
Details
Dependency Updates
API Breaking Changes Fixed
Minimatch v10 introduced breaking changes in its export structure. Updated import statements:
Before (v3):
import minimatch from 'minimatch';After (v10):
import { minimatch } from 'minimatch';Files Updated
Lock files and repo state hashes updated
Configuration Management
How it was tested