chore: updating minimatch - #19434

Merged
andreiborza merged 3 commits into
developfrom
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged

chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom
isaacschlueter/js-1765-vulnerable-dependency-minimatch

Conversation

@isaacs

@isaacsisaacs commented Feb 19, 2026

Copy link
Copy Markdown
Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core

There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.

Before submitting a pull request, please take a look at our
Contributing guidelines and verify:

  • If you've added code that should be tested, please add tests.
  • Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  • Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.

Closes #issue_link_here

@linear

linearBot commented Feb 19, 2026

Copy link
Copy Markdown

JS-1765 Vulnerable dependency: Minimatch

@github-actions

github-actionsBot commented Feb 19, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

size-limit report 📦

PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺

View base workflow run

@github-actions

github-actionsBot commented Feb 19, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%

View base workflow run

@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 0926993 to 101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit that referenced this pull request Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 101e9f9 to 43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs marked this pull request as ready for review February 23, 2026 23:17
cursor[bot]
cursorBot reviewed Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json Outdated
isaacs added a commit that referenced this pull request Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 43842b9 to c13f91cCompareFebruary 23, 2026 23:45
@isaacs

isaacs commented Feb 23, 2026

Copy link
Copy Markdown
MemberAuthor

Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.

cursor[bot]
cursorBot reviewed Feb 23, 2026
View reviewed changes

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadpackages/remix/package.json
isaacs added a commit that referenced this pull request Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from c13f91c to 944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot reviewed Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json Outdated
isaacs added a commit that referenced this pull request Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 944ed68 to acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot reviewed Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs

isaacs commented Feb 24, 2026

Copy link
Copy Markdown
MemberAuthor

Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.

isaacs added a commit that referenced this pull request Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from acbd011 to 033e930CompareFebruary 25, 2026 01:10
@isaacs

isaacs commented Feb 25, 2026

Copy link
Copy Markdown
MemberAuthor

This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj

andreiborza
andreiborza approved these changes Feb 25, 2026
View reviewed changes

@andreiborzaandreiborza left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)

@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch from 5d2db35 to 18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot reviewed Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot reviewed Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot reviewed Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza approved these changes Feb 26, 2026
View reviewed changes

@andreiborzaandreiborza left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)

@andreiborza
andreiborza merged commit 4ff6738 into developFeb 26, 2026
437 of 439 checks passed
@andreiborza
andreiborza deleted the isaacschlueter/js-1765-vulnerable-dependency-minimatch branch February 26, 2026 12:24
@lucas-zimermanlucas-zimerman mentioned this pull request Feb 27, 2026
Merged
3 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore: updating minimatch - #19434
Merged
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Feb 26, 2026
Merged
chore: updating minimatch#19434
andreiborza merged 3 commits into
developfrom 
isaacschlueter/js-1765-vulnerable-dependency-minimatch
Conversation
@isaacs
@isaacsisaacs
commented
Feb 19, 2026

Copy link


Copy Markdown

Member
  • Adding a devDependency on minimatch in the root, so that all outdated versions get pushed into duplicates.
  • Updated minimatch direct dependency packages/node, packages/react-router, and packages/remix
  • Once chore!: updating minimatch sentry-javascript-bundler-plugins#885 lands, we can update the dependency coming in from @sentry/bundler-plugin-core
There are several other dependencies that transitively bring in a minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported where those dependencies cannot be easily updated.
Before submitting a pull request, please take a look at our
Contributing guidelines and verify:
  •  If you've added code that should be tested, please add tests.
  •  Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
  •  Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
Closes #issue_link_here
@linear
linearBot
commented
Feb 19, 2026

Copy link


Copy Markdown

JS-1765 Vulnerable dependency: Minimatch
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
size-limit report 📦
PathSize% ChangeChange
@sentry/browser25.62 kB--
@sentry/browser - with treeshaking flags24.12 kB--
@sentry/browser (incl. Tracing)42.42 kB--
@sentry/browser (incl. Tracing, Profiling)47.09 kB--
@sentry/browser (incl. Tracing, Replay)81.24 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags70.86 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)85.94 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)98.2 kB--
@sentry/browser (incl. Feedback)42.43 kB--
@sentry/browser (incl. sendFeedback)30.29 kB--
@sentry/browser (incl. FeedbackAsync)35.34 kB--
@sentry/browser (incl. Metrics)26.79 kB--
@sentry/browser (incl. Logs)26.93 kB--
@sentry/browser (incl. Metrics & Logs)27.61 kB--
@sentry/react27.37 kB--
@sentry/react (incl. Tracing)44.76 kB--
@sentry/vue30.07 kB--
@sentry/vue (incl. Tracing)44.27 kB--
@sentry/svelte25.64 kB--
CDN Bundle28.16 kB--
CDN Bundle (incl. Tracing)43.25 kB--
CDN Bundle (incl. Logs, Metrics)29 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)44.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics)68.08 kB--
CDN Bundle (incl. Tracing, Replay)80.13 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)80.99 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)85.64 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.53 kB--
CDN Bundle - uncompressed82.34 kB--
CDN Bundle (incl. Tracing) - uncompressed128.06 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed85.18 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed130.89 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed208.84 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed244.94 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed247.76 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed257.85 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed260.66 kB--
@sentry/nextjs (client)47.17 kB--
@sentry/sveltekit (client)42.88 kB--
@sentry/node-core52.18 kB+0.02%+8 B 🔺
@sentry/node174.33 kB+0.51%+881 B 🔺
@sentry/node - without tracing97.32 kB+0.01%+9 B 🔺
@sentry/aws-serverless113.13 kB+0.01%+5 B 🔺
View base workflow run
@github-actions
github-actionsBot
commented
Feb 19, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
node-overhead report 🧳
Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline8,317-8,806-6%
GET With Sentry1,56319%1,675-7%
GET With Sentry (error only)5,71869%6,155-7%
POST Baseline1,150-1,195-4%
POST With Sentry53847%541-1%
POST With Sentry (error only)1,00187%1,056-5%
MYSQL Baseline3,142-3,205-2%
MYSQL With Sentry36712%371-1%
MYSQL With Sentry (error only)2,54181%2,654-4%
View base workflow run
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
0926993 to
101e9f9CompareFebruary 23, 2026 23:14
isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
43842b9
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
101e9f9 to
43842b9CompareFebruary 23, 2026 23:16
@isaacs
isaacs
marked this pull request as ready for review
February 23, 2026 23:17
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
Comment threadpackages/node/package.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 23, 2026
@isaacs
chore: updating minimatch (#19434)
c13f91c
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
43842b9 to
c13f91cCompareFebruary 23, 2026 23:45
@isaacs
isaacs
commented
Feb 23, 2026

Copy link


Copy Markdown

MemberAuthor
Dependency review CI is still catching up. The minimatch versions it's flagging all have the fix for the CVE, just waiting on it to go through the GH advisory workflow. The license for glob and rimraf are BlueOak-1.0.0, which was just recently approved in our fossa instance.
cursor[bot]
cursorBot
reviewed
Feb 23, 2026
View reviewed changes
@cursorcursorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
Comment threadpackages/remix/package.json
isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
944ed68
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
c13f91c to
944ed68CompareFebruary 24, 2026 17:33
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
Comment threadpackage.json
Outdated

isaacs added a commit
that referenced
this pull request
Feb 24, 2026
@isaacs
chore: updating minimatch (#19434)
acbd011
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
944ed68 to
acbd011CompareFebruary 24, 2026 18:44
sentry[bot]
sentryBot
reviewed
Feb 24, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
isaacs
commented
Feb 24, 2026

Copy link


Copy Markdown

MemberAuthor
Looks like the meat of this was covered in #19486, but this is still worth landing for the glob/rimraf fixes.
isaacs added a commit
that referenced
this pull request
Feb 25, 2026
@isaacs
chore: updating minimatch (#19434)
033e930
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
acbd011 to
033e930CompareFebruary 25, 2026 01:10
@isaacs
isaacs
commented
Feb 25, 2026

Copy link


Copy Markdown

MemberAuthor
This now updates all transitive deps in the lockfile, adds a few overrides for stubborn minimatch-pinning deps, and gets us out of both GHSA-23c5-xmqv-rm74 and GHSA-7r86-cg39-jmmj
andreiborza
andreiborza
approved these changes
Feb 25, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for taking care of this, especially across the various libraries and versions :)
@isaacs
chore: updating minimatch (#19434)
18b37ac
- Updated `minimatch` direct dependency in our packages (packages/node,
packages/react-router, and packages/remix)
- Added some yarn resolutions for old pinned versions of minimatch that
are unlikely to be updated in their respective dependencies.
fixes JS-1765
fixes#19431
@isaacs
isaacsforce-pushed
the
isaacschlueter/js-1765-vulnerable-dependency-minimatch
branch
from
5d2db35 to
18b37acCompareFebruary 25, 2026 17:30
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/package.json
@isaacs
chore: replace glob.sync with globSync
6a8aca4
Cursor is convince that glob.sync went away. No harm in making it happy.
sentry[bot]
sentryBot
reviewed
Feb 25, 2026
View reviewed changes
Comment threadpackages/remix/scripts/deleteSourcemaps.js
andreiborza
andreiborza
approved these changes
Feb 26, 2026
View reviewed changes
@andreiborzaandreiborza
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for taking care of this again :)
@andreiborza
andreiborza
merged commit 4ff6738
into
developFeb 26, 2026

437 of 439 checks passed

@andreiborza
andreiborza
deleted the

isaacschlueter/js-1765-vulnerable-dependency-minimatch

branch
February 26, 2026 12:24
@lucas-zimermanlucas-zimerman
mentioned this pull request
Feb 27, 2026
 Merged

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sentrysentry[bot]sentry[bot] left review comments
@cursorcursor[bot]cursor[bot] left review comments
@andreiborzaandreiborzaandreiborza approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@isaacs@andreiborza