Skip to content

[Security] Bump minimatch from 3.0.4 to 3.1.2

Dependabot requested to merge dependabot-npm_and_yarn-minimatch-3.1.2 into master

Bumps minimatch from 3.0.4 to 3.1.2. This update includes a security fix.

Vulnerabilities fixed

minimatch ReDoS vulnerability A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Patched versions: 3.0.5 Affected versions: < 3.0.5

Commits


Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports