istanbuljs / istanbuljs/test-exclude

Request to update Minimatch dependency (security vulnerability)

Open
#68 0 comments 5 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
10
Forks
18
PR merge metrics
No merged PRs in 30d

Description

As can be seen in this [GH Advisory](https://github.com/advisories/GHSA-3ppc-4f35-3m26), minimatch versions < 10.2.1 are affected by this vulnerability.

When overriding the dependency to the fixed version, the following error occurs:
```ts
TypeError: : minimatch is not a function

> 1 | import '';
| ^

at matches (../../node_modules/test-exclude/index.js:99:36)
at Array.some ()
at TestExclude.shouldInstrument (../../node_modules/test-exclude/index.js:102:28)
at shouldSkip (../../node_modules/babel-plugin-istanbul/lib/index.js:83:21)
at PluginPass.enter (../../node_modules/babel-plugin-istanbul/lib/index.js:97:15)
```

I see there is already a PR open (#65) to replace minimatch with micromatch.

Could we either:

- Get PR #65 merged
- Or update minimatch to version 10.2.1

so that test-exclude does not rely on a vulnerable minimatch version?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing PR #65 and the dependency declaration, then reproduce the reported TypeError from test-exclude/index.js around line 99. Confirm the chosen dependency update removes reliance on the vulnerable minimatch version and that the affected tests no longer fail.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.