Embedded SDK 2.2.6: qualify fixed glob/minimatch dependencies used by discovery #62920

Activity

1. opencodejr commented on Nov 9, 2026

   

   opencodejrBot

   on Nov 9, 2026

   More actions

   Thanks for the detailed report. I can confirm this. With a clean npm install --save-exact @opencode/sdk@2.2.6, npm ls shows @opencode/util@2.2.6 installing glob@13.0.5 and minimatch@10.2.5. npm audit --omit=dev flags glob for GHSA-3g3m-2fjr-6pw4 and minimatch for GHSA-g3hv-75wg-m249, and says "No fix available" for both under the current pins.

   The latest dev (617a770) still pins the same versions in packages/util/package.json, so this hasn't been changed yet.

   Two more things I noticed:

   • Glob.scan in packages/util/src/glob.ts calls glob() without passing an AbortSignal, so the glob advisory's cancellation path probably isn't reached through it. The audit finding stays either way.
   • Other dependencies in the SDK tree (e.g. @npmcli/arborist, pacote, rimraf, @tufjs/models) also bring in flagged glob/minimatch versions. Bumping @opencode/util's direct pins alone may not fully clear the audit.

   The script below reproduces the audit result. Related earlier reports: #34181 and #34139 (older minimatch ReDoS advisories, which led to the 10.2.5 pin) and #47843 (a bulk CVE bump that was not merged).

   Reproduction script (audit.sh)

   #!/usr/bin/env bash
   # Reproduces #62920: @opencode/sdk@2.2.6 installs glob@13.0.5 / minimatch@10.2.5 flagged by npm audit.
   set -euo pipefail
   dir=$(mktemp -d); cd "$dir"
   npm init -y >/dev/null
   npm install --save-exact --ignore-scripts @opencode/sdk@2.2.6 >/dev/null 2>&1
   npm ls @opencode/util glob minimatch | grep -E '@opencode/util@|glob@|minimatch@' | sort -u | head -20
   npm audit --omit=dev 2>&1 | grep -E -A3 '^(glob|minimatch) ' || true

   Run it: bash audit.sh
2. opencodejr

   added

   reproduced

   on Nov 9, 2026