Skip to content

chore(deps): remove glob/minimatch/test-exclude npm overrides once jest and eslint ship patched ranges #668

Open

Description

@don-petry

#667 adds these package.json overrides to clear GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch):

"glob": "^14.0.2",
"minimatch": "^11.0.1",
"test-exclude": "^7.0.2"

They force major versions that the parents don't declare. As of 2026-11-04, jest 30.5.2 still requires glob ^13.0.6, and eslint 10.14.0, @eslint/config-array 0.23.5 and @typescript-eslint/typescript-estree 8.72.1 still require minimatch ^10. babel-plugin-istanbul 7.0.1 still requires test-exclude ^6.

Remove each override when:

  • glob: @jest/reporters, jest-config and jest-runtime depend on glob >=14.0.2
  • minimatch: eslint, @eslint/config-array and @typescript-eslint/typescript-estree depend on minimatch >=11.0.1
  • test-exclude: dropped together with glob/minimatch (it only exists so babel-plugin-istanbul uses the named-export APIs)

Check by removing the override, running npm install with npm 10 (CI's version), and confirming that npm ci and npm audit are clean.

Activity

  1. don-petry commented on Nov 4, 2026

    @don-petry
    CollaboratorAuthor

    dev-lead is withholding action on this item.

    It is labeled dev-lead:hands-off (deliberately kept off-limits to dev-lead (e.g. changes to the dev-lead automation itself)), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.

    To re-enable automated pickup: remove the dev-lead:hands-off label.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dev-lead:hands-offExclude from dev-lead agent automation

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions