chore!: updating minimatch by isaacs · Pull Request #885 · getsentry/sentry-javascript-bundler-plugins

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs · 2026-02-19T18:19:31Z

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10.

The following packages depend on minimatch v3:

@eslint/eslintrc
@humanwhocodes/config-array
@jest/core
copy-concurrently
eslint
eslint-plugin-react
jest-circus
jest-config
jest-runner
move-concurrently
rimraf
terser-webpack-plugin
test-exclude

Finally, @rollup/plugin-commonjs depends on minimatch 5.1.6.

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

linear · 2026-02-19T18:19:35Z

JS-1765 Vulnerable dependency: Minimatch

github-actions · 2026-02-19T18:19:48Z

Semver Impact of This PR

🔴 Major (breaking changes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

Breaking Changes 🛠

Updating minimatch by isaacs in #885

Remove support for Node < v18 and webpack v4 by timfish in #886

Bug Fixes 🐛

(webpack) Deduplicate webpack deploys by chargome in #875

Internal Changes 🔧

Avoid direct usage of glob, extract into globFiles helper by andreiborza in #883
Migrate to oxfmt by timfish in #880
Build with Rolldown by timfish in #872
Remove unplugin by timfish in #876
Rollup/Vite no longer uses unplugin by timfish in #858
Esbuild no longer uses unplugin by timfish in #871
Webpack no longer uses unplugin by timfish in #870

_{🤖 This preview updates automatically when you update the PR.}

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-23T09:51:29Z

 "dotenv": "^16.3.1",
 "find-up": "^5.0.0",
- "glob": "^10.5.0",
+ "glob": "^13.0.6",


Node version mismatch with glob dependency
High Severity
The package specifies engines.node >= 14 but includes glob@^13.0.6 as a production dependency, which requires Node.js >= 20. This creates a version mismatch where users on Node 14-19 can install the package but glob will fail at runtime, causing crashes when glob operations are executed.

Add minimatch@10.2.2 dev dep in the root to push outdated versions into duplicates, and local packages were updated to use minimatch v10. The following packages depend on minimatch v3: - @eslint/eslintrc - @humanwhocodes/config-array - @jest/core - copy-concurrently - eslint - eslint-plugin-react - jest-circus - jest-config - jest-runner - move-concurrently - rimraf - terser-webpack-plugin - test-exclude Finally, `@rollup/plugin-commonjs` depends on minimatch 5.1.6. A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza · 2026-02-23T11:31:34Z

A fix will be backported to resolve the ReDOS on v3 and v5, which can then be updated here.

I bumped to the latest v3 and v5 of minimatch and the latest v5 of brace-expansion, all published recently.

minimatch 3.1.2 → 3.1.3
minimatch 5.1.6 → 5.1.7
brace-expansion 5.0.2 → 5.0.3

@isaacs

- Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates. - Updated `minimatch` direct dependency packages/node, packages/react-router, and packages/remix - Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from `@sentry/bundler-plugin-core` There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated. Before submitting a pull request, please take a look at our [Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify: - [ ] If you've added code that should be tested, please add tests. - [ ] Ensure your code lints and the test suite passes (`yarn lint`) & (`yarn test`). - [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked. Closes #issue_link_here

@timfish

@timfish

@timfish

isaacs force-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 9c89009 to f1d3304Compare February 19, 2026 18:20

isaacs mentioned this pull request Feb 19, 2026
chore: updating minimatch getsentry/sentry-javascript#19434
Merged
3 tasks

isaacs force-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from f1d3304 to 3d46820Compare February 20, 2026 17:00

isaacs marked this pull request as ready for review February 20, 2026 17:00

sentryBot reviewed Feb 23, 2026
View reviewed changes

Comment threadpackages/bundler-plugin-core/package.json

cursorBot reviewed Feb 23, 2026
View reviewed changes

andreiborza changed the title ~~chore: updating minimatch~~chore!: updating minimatchFeb 23, 2026

andreiborza added the Meta: Breaking label Feb 23, 2026

isaacsand others added 2 commits February 23, 2026 12:03

Bump balanced-match in lockfile to 4.0.4
6b2327a

andreiborza force-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 5bb07e0 to 6b2327aCompare February 23, 2026 11:03

andreiborza added 2 commits February 23, 2026 12:14

Bump minimatch v3 and v5 usages
7cf8cd0

Bump minimatch and brace-expansion in lockfile to patched versions
5f05b54
- minimatch 3.1.2 → 3.1.3 - minimatch 5.1.6 → 5.1.7 - brace-expansion 5.0.2 → 5.0.3

andreiborza approved these changes Feb 23, 2026
View reviewed changes

chargome approved these changes Feb 23, 2026
View reviewed changes

andreiborza merged commit 8781545 into mainFeb 23, 2026
34 of 36 checks passed

andreiborza deleted the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch February 23, 2026 11:43

sentry-release-botBot mentioned this pull request Feb 23, 2026
publish: getsentry/sentry-javascript-bundler-plugins@5.0.0 getsentry/publish#7238
Closed
7 tasks