Repository navigation
chore(opencode): bump minimatch for ReDoS advisories #34139
Description
I was running a local dependency scan with Guardian and noticed packages/opencode still pins minimatch@10.0.3.
That version is in the affected range for two public ReDoS advisories:
The practical risk is that certain attacker-controlled glob patterns can create very slow regular-expression matching. I am not claiming this is actively exploitable in opencode, but since minimatch is a direct dependency of packages/opencode, it seems worth patching.
The fix looks small: bump packages/opencode from minimatch@10.0.3 to 10.2.5. packages/core already uses 10.2.5, so this keeps the workspace aligned and removes the stale scoped lockfile entry.
I have a small PR ready if that approach looks acceptable.
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Jun 27, 2026
This issue doesn't fully meet our contributing guidelines.
What needs to be fixed:
Please edit this issue to address the above within 2 hours, or it will be automatically closed.
If you believe this was flagged incorrectly, please let a maintainer know.
github-actions commentedon Jun 27, 2026
This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.
Feel free to open a new issue that follows our issue templates.