istanbuljs / istanbuljs/test-exclude
Request to update Minimatch dependency (security vulnerability)
- Dominant language
- JavaScript
- Stars
- 10
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
As can be seen in this [GH Advisory](https://github.com/advisories/GHSA-3ppc-4f35-3m26), minimatch versions < 10.2.1 are affected by this vulnerability.
When overriding the dependency to the fixed version, the following error occurs:
```ts
TypeError: : minimatch is not a function
> 1 | import '';
| ^
at matches (../../node_modules/test-exclude/index.js:99:36)
at Array.some ()
at TestExclude.shouldInstrument (../../node_modules/test-exclude/index.js:102:28)
at shouldSkip (../../node_modules/babel-plugin-istanbul/lib/index.js:83:21)
at PluginPass.enter (../../node_modules/babel-plugin-istanbul/lib/index.js:97:15)
```
I see there is already a PR open (#65) to replace minimatch with micromatch.
Could we either:
- Get PR #65 merged
- Or update minimatch to version 10.2.1
so that test-exclude does not rely on a vulnerable minimatch version?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing PR #65 and the dependency declaration, then reproduce the reported TypeError from test-exclude/index.js around line 99. Confirm the chosen dependency update removes reliance on the vulnerable minimatch version and that the affected tests no longer fail.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100