Update minimatch to avoid vulnerable brace-expansion version
Open
- Dominant language
- JavaScript
- Stars
- 7
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/bcoe/dotgitignore/blob/13e96d88caba0291aaa7b3fbcb0d6b7c73cf57eb/package.json#L29
Minimatch ^3.0.4 resolves for me to 3.1.5 which references brace-expansion 1.1.6
Which is affected by [CVE-2026-14257](https://nvd.nist.gov/vuln/detail/CVE-2026-14257).
I know that the library is likely not used in a vulnerable way, but it would be nice, if you could update your library in order to avoid the CVE warnings downstream.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.