From 83a25ea16f2b54890b07920486fff834604a488a Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Sun, 1 Nov 2026 18:59:38 +0300 Subject: [PATCH] chore(deps): resolve minimatch and glob audit advisories (WealthLedger/main#49) --- .dockerignore | 3 + Dockerfile | 1 + knip.json | 2 +- package-lock.json | 176 ++++++-------------------- package.json | 7 +- scripts/minimatch-compat/index.cjs | 9 ++ scripts/minimatch-compat/index.js | 11 ++ scripts/minimatch-compat/package.json | 14 ++ 8 files changed, 84 insertions(+), 139 deletions(-) create mode 100644 scripts/minimatch-compat/index.cjs create mode 100644 scripts/minimatch-compat/index.js create mode 100644 scripts/minimatch-compat/package.json diff --git a/.dockerignore b/.dockerignore index bdbb86c..653fc9b 100644 --- a/.dockerignore +++ b/.dockerignore @@ -13,6 +13,9 @@ !public/** !docker/ !docker/** +!scripts/ +!scripts/minimatch-compat/ +!scripts/minimatch-compat/** !packages/ !packages/tokens/ !packages/tokens/package.json diff --git a/Dockerfile b/Dockerfile index 2795607..31c3f57 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,6 +5,7 @@ COPY package.json package-lock.json ./ COPY packages/tokens/package.json ./packages/tokens/ COPY packages/ui/package.json ./packages/ui/ COPY packages/icons/package.json ./packages/icons/ +COPY scripts/minimatch-compat ./scripts/minimatch-compat RUN npm ci FROM dependencies AS development diff --git a/knip.json b/knip.json index 5f5b315..a31ed98 100644 --- a/knip.json +++ b/knip.json @@ -1,5 +1,5 @@ { - "ignoreDependencies": ["conventional-changelog-conventionalcommits"], + "ignoreDependencies": ["conventional-changelog-conventionalcommits", "minimatch"], "workspaces": { ".": { "project": ["src/**/*.{ts,tsx}", "!src/shared/api/generated/**"] diff --git a/package-lock.json b/package-lock.json index ff08565..088ef5f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -80,6 +80,7 @@ "jsdom": "30.1.3", "knip": "6.43.0", "lint-staged": "17.6.0", + "minimatch": "file:scripts/minimatch-compat", "msw": "2.15.0", "openapi-typescript": "7.13.0", "playwright": "1.64.1", @@ -88,7 +89,7 @@ "typescript": "5.9.3", "typescript-eslint": "8.72.0", "vite": "8.3.5", - "vite-plugin-pwa": "1.3.0", + "vite-plugin-pwa": "2.0.0", "vitest": "5.0.5" }, "engines": { @@ -2511,14 +2512,12 @@ } } }, - "node_modules/@isaacs/cliui": { - "version": "9.0.0", - "integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==", + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", "dev": true, - "license": "BlueOak-1.0.0", - "engines": { - "node": ">=18" - } + "license": "BlueOak-1.0.0" }, "node_modules/@joshwooding/vite-plugin-react-docgen-typescript": { "version": "0.7.0", @@ -3720,33 +3719,6 @@ "npm": ">=9.5.0" } }, - "node_modules/@redocly/openapi-core/node_modules/balanced-match": { - "version": "1.0.2", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true, - "license": "MIT" - }, - "node_modules/@redocly/openapi-core/node_modules/brace-expansion": { - "version": "2.1.7", - "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/@redocly/openapi-core/node_modules/minimatch": { - "version": "5.1.9", - "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^2.0.1" - }, - "engines": { - "node": ">=10" - } - }, "node_modules/@reduxjs/toolkit": { "version": "2.12.0", "integrity": "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==", @@ -6448,6 +6420,7 @@ }, "node_modules/balanced-match": { "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", "dev": true, "license": "MIT", @@ -6495,6 +6468,7 @@ }, "node_modules/brace-expansion": { "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", @@ -9097,33 +9071,6 @@ "minimatch": "^5.0.1" } }, - "node_modules/filelist/node_modules/balanced-match": { - "version": "1.0.2", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true, - "license": "MIT" - }, - "node_modules/filelist/node_modules/brace-expansion": { - "version": "2.1.7", - "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/filelist/node_modules/minimatch": { - "version": "5.1.9", - "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^2.0.1" - }, - "engines": { - "node": ">=10" - } - }, "node_modules/find-up": { "version": "5.0.0", "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==", @@ -9194,22 +9141,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/foreground-child": { - "version": "3.3.1", - "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==", - "dev": true, - "license": "ISC", - "dependencies": { - "cross-spawn": "^7.0.6", - "signal-exit": "^4.0.1" - }, - "engines": { - "node": ">=14" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, "node_modules/formatly": { "version": "0.11.4", "resolved": "https://registry.npmjs.org/formatly/-/formatly-0.11.4.tgz", @@ -9488,14 +9419,15 @@ } }, "node_modules/glob": { - "version": "13.0.6", - "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==", + "version": "14.0.3", + "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz", + "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "minimatch": "^10.2.2", + "minimatch": "^11.0.2", "minipass": "^7.1.3", - "path-scurry": "^2.0.2" + "path-scurry": "^3.0.0" }, "engines": { "node": "18 || 20 || >=22" @@ -10670,21 +10602,6 @@ "node": "^18.17 || >=20.6.1" } }, - "node_modules/jackspeak": { - "version": "4.2.3", - "integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "@isaacs/cliui": "^9.0.0" - }, - "engines": { - "node": "20 || >=22" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, "node_modules/jake": { "version": "10.9.4", "integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==", @@ -11473,12 +11390,19 @@ } }, "node_modules/minimatch": { - "version": "10.2.6", - "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", + "resolved": "scripts/minimatch-compat", + "link": true + }, + "node_modules/minimatch-11": { + "name": "minimatch", + "version": "11.0.2", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz", + "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.8" + "@isaacs/nonrecursive-glob-match": "^1.0.2", + "brace-expansion": "^5.0.12" }, "engines": { "node": "18 || 20 || >=22" @@ -12212,12 +12136,6 @@ "quickjs-wasi": "^2.2.0" } }, - "node_modules/package-json-from-dist": { - "version": "1.0.1", - "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==", - "dev": true, - "license": "BlueOak-1.0.0" - }, "node_modules/package-manager-detector": { "version": "1.9.0", "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.9.0.tgz", @@ -12314,8 +12232,9 @@ "license": "MIT" }, "node_modules/path-scurry": { - "version": "2.0.2", - "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==", + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz", + "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { @@ -15929,8 +15848,9 @@ } }, "node_modules/vite-plugin-pwa": { - "version": "1.3.0", - "integrity": "sha512-c5kMgN+ITrOtHXp8PAtk2uOIEea6XjP/unCGxOWWBzQ6qa65qj/awHg0wf+QF9E/2u9vh86LqxPwzEPNbM2r5A==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/vite-plugin-pwa/-/vite-plugin-pwa-2.0.0.tgz", + "integrity": "sha512-6G9dsPKT9QKYpeTuTLJM28zZL3HsXUTUM/QUZBEgQk2jbfrPJDq2i8gTewAKqi1c9Mt6MiidrL4SFI+HthiQMg==", "dev": true, "license": "MIT", "dependencies": { @@ -15941,13 +15861,13 @@ "workbox-window": "^7.4.1" }, "engines": { - "node": ">=16.0.0" + "node": ">=20.19.0" }, "funding": { "url": "https://github.com/sponsors/antfu" }, "peerDependencies": { - "@vite-pwa/assets-generator": "^1.0.0", + "@vite-pwa/assets-generator": "^1.0.0 || ^2.0.0", "vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0", "workbox-build": "^7.4.1", "workbox-window": "^7.4.1" @@ -17642,30 +17562,6 @@ "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0" } }, - "node_modules/workbox-build/node_modules/glob": { - "version": "11.1.0", - "integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==", - "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "foreground-child": "^3.3.1", - "jackspeak": "^4.1.1", - "minimatch": "^10.1.1", - "minipass": "^7.1.2", - "package-json-from-dist": "^1.0.0", - "path-scurry": "^2.0.0" - }, - "bin": { - "glob": "dist/esm/bin.mjs" - }, - "engines": { - "node": "20 || >=22" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, "node_modules/workbox-build/node_modules/lru-cache": { "version": "5.1.1", "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==", @@ -18076,6 +17972,14 @@ "react": "19.3.1", "react-dom": "19.3.1" } + }, + "scripts/minimatch-compat": { + "name": "minimatch", + "version": "11.0.2-compat.0", + "dev": true, + "dependencies": { + "minimatch-11": "npm:minimatch@11.0.2" + } } } } diff --git a/package.json b/package.json index 168e6da..8332da8 100644 --- a/package.json +++ b/package.json @@ -106,6 +106,7 @@ "jsdom": "30.1.3", "knip": "6.43.0", "lint-staged": "17.6.0", + "minimatch": "file:scripts/minimatch-compat", "msw": "2.15.0", "openapi-typescript": "7.13.0", "playwright": "1.64.1", @@ -114,7 +115,7 @@ "typescript": "5.9.3", "typescript-eslint": "8.72.0", "vite": "8.3.5", - "vite-plugin-pwa": "1.3.0", + "vite-plugin-pwa": "2.0.0", "vitest": "5.0.5" }, "overrides": { @@ -124,7 +125,9 @@ }, "@vitest/browser": "5.0.5", "@vitest/ui": "5.0.5", - "@vitest/mocker": "5.0.5" + "@vitest/mocker": "5.0.5", + "minimatch": "$minimatch", + "glob": "14.0.3" }, "allowScripts": { "esbuild@0.28.2": true, diff --git a/scripts/minimatch-compat/index.cjs b/scripts/minimatch-compat/index.cjs new file mode 100644 index 0000000..f1e6908 --- /dev/null +++ b/scripts/minimatch-compat/index.cjs @@ -0,0 +1,9 @@ +// ponytail: CommonJS twin of index.js (import-x ships lib/index.cjs too). +const minimatch = require("minimatch-11"); + +module.exports = { + ...minimatch, + makeRe: (pattern, options = {}) => ({ + test: path => minimatch.minimatch(path, pattern, options), + }), +}; diff --git a/scripts/minimatch-compat/index.js b/scripts/minimatch-compat/index.js new file mode 100644 index 0000000..eeab204 --- /dev/null +++ b/scripts/minimatch-compat/index.js @@ -0,0 +1,11 @@ +// ponytail: shim for eslint-plugin-import-x@4.17.1, which still imports the +// makeRe export removed in minimatch 11. Its only caller (no-internal-modules) +// uses the result via .test(), so a matcher object is enough. Delete this +// package and the override once import-x supports minimatch 11. +import { minimatch } from "minimatch-11"; + +export * from "minimatch-11"; + +export const makeRe = (pattern, options = {}) => ({ + test: path => minimatch(path, pattern, options), +}); diff --git a/scripts/minimatch-compat/package.json b/scripts/minimatch-compat/package.json new file mode 100644 index 0000000..9e0832a --- /dev/null +++ b/scripts/minimatch-compat/package.json @@ -0,0 +1,14 @@ +{ + "name": "minimatch", + "version": "11.0.2-compat.0", + "private": true, + "description": "minimatch 11 plus the makeRe export eslint-plugin-import-x 4.17.1 still imports. Remove when import-x supports minimatch 11.", + "type": "module", + "exports": { + "import": "./index.js", + "require": "./index.cjs" + }, + "dependencies": { + "minimatch-11": "npm:minimatch@11.0.2" + } +} -- 2.54.0