[GHSA-3ppc-4f35-3m26] minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

[robinbisping]

Updates

• Affected products

Comments
The developer has also backported the fix to previous major versions. See: GHSA-3ppc-4f35-3m26

[github]

Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Updates the GHSA advisory record for minimatch to reflect additional fixed versions across multiple major release lines, aligning the advisory’s affected ranges with the upstream backports mentioned in the GHSA.

Changes:

• Narrowed the v10 affected range to start at 10.0.0 (instead of 0) and kept the fix at 10.2.1.
• Added explicit affected ranges for minimatch v4–v9 with their corresponding patched versions.
• Updated the advisory modified timestamp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[timbru31]

Duplicate of #7002 (nope there is no way to see the list of open PRs when suggesting an improvement...)