Repository navigation
chore(deps): upgrade glob to v14 to fix GHSA-3g3m-2fjr-6pw4 - #16556
Open
bertolo1988 wants to merge 3 commits into
Open
bertolo1988 wants to merge 3 commits into
bertolo1988 wants to merge 3 commits into
Conversation
glob <= 14.0.1 does not stop a walk when its signal aborts: the abort branches in walker.ts call cb() without returning, so an aborted or timed-out walk keeps reading directories in the background. Bump jest's direct glob dependency from ^13.0.6 to ^14.0.3 in jest-config, jest-runtime, jest-reporters and the root devDependencies. ^14.0.3 is the lowest 14.x that only allows minimatch ^11.0.2+ (the release patched for GHSA-g3hv-75wg-m249); the lock resolves glob 14.0.4 with minimatch 11.0.5. Relates to jestjs#16529.
✅ Deploy Preview for jestjs ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
babel-jest
babel-plugin-jest-hoist
babel-preset-jest
create-jest
@jest/diff-sequences
expect
@jest/expect-utils
jest
jest-changed-files
jest-circus
jest-cli
jest-config
@jest/console
@jest/core
@jest/create-cache-key-function
jest-diff
jest-docblock
jest-each
@jest/environment
jest-environment-jsdom
@jest/environment-jsdom-abstract
jest-environment-node
@jest/expect
@jest/fake-timers
@jest/get-type
@jest/globals
jest-haste-map
jest-jasmine2
jest-leak-detector
jest-matcher-utils
jest-message-util
jest-mock
@jest/pattern
jest-phabricator
jest-regex-util
@jest/reporters
jest-resolve
jest-resolve-dependencies
jest-runner
jest-runtime
@jest/schemas
jest-snapshot
@jest/snapshot-utils
@jest/source-map
@jest/test-result
@jest/test-sequencer
@jest/transform
@jest/types
jest-util
jest-validate
jest-watcher
jest-worker
pretty-format
commit: |
Author
|
recheck |
Author
|
/easycla |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the moderate advisory GHSA-3g3m-2fjr-6pw4 (CVE-2026-118773): in
glob<= 14.0.1 the abort branches insrc/walker.ts(GlobUtil.walkCB,GlobUtil.walkCB2,GlobUtil.walkCBSync,GlobUtil.walkCB2Sync) callcb()withoutreturn, so a cancelled walk (e.g. viaAbortSignal.timeout()) continues recursively reading directories in the background.Moves jest's direct
globdependency from^13.0.6to^14.0.3in:jest-configjest-runtimejest-reportersdevDependencies^14.0.3is chosen deliberately rather than^14.0.0: 14.0.0–14.0.2 declareminimatch@^11.0.0, which still admits the unpatched11.0.0, while14.0.3requiresminimatch@^11.0.2and therefore also excludes minimatch from the GHSA-g3hv-75wg-m249 range in the shipped tree.Test plan
yarn install --immutable✔yarn build✔yarn jest packages/jest-config packages/jest-runtime packages/jest-reporters --silent✔Notes
glob@10.5.0copy comes fromtest-exclude(viababel-plugin-istanbul), which is maintained under istanbuljs and outside jest's control (also called out in [Vulnerability]: Update glob dependencies to address GHSA-3g3m-2fjr-6pw4 #16529).glob@7.xused byrimraf@3,glob@13.0.6used by npm CLI internals) are not shipped to consumers and are left untouched to avoid breaking the dev toolchain.