[GHSA-3ppc-4f35-3m26] minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

[jswalden]

Updates

• Affected products

Comments
I should preface this all by saying I am an only slightly interested downstream consumer of these and not a modulo aficionado so take these suggestions as at least somewhat uncertain!

The 10.* line has a fix in it, but this seems to still treat prior major-version lines' fixes as inadequate to the day. I am entirely unsure whether the backported fixes are solving the entire problem, or only part of it. But if we presume the backported fixes are "enough" of a solution -- I stress again that I do not entirely know whether this is the case! -- then the newer releases within those lines ought be permitted to resolve a dependabot security alert.

minimatch 1.0.1:

• isaacs/minimatch@7a2ce1e tagged release
• isaacs/minimatch@7a2ce1e4c32e01d1a8e78c5f45e985843c616c60^ commit making the fix

minimatch 2.0.11:

• isaacs/minimatch@2090514 tagged release
• isaacs/minimatch@209051434519f51f7d3806528627e6615cb280a9^ commit making the fix

minimatch 3.1.3:

• isaacs/minimatch@00c323b tagged release
• isaacs/minimatch@00c323b188b704e5d4bc534ecec2268cfa70a32a^^^ commit making the fix

minimatch 4.2.4:

• isaacs/minimatch@63edb3d tagged release
• isaacs/minimatch@63edb3d6d00eb57ee7fdea89740a90d2323d065f^^^ commit making the fix

minimatch 5.1.7:

• isaacs/minimatch@85646c8 tagged release
• isaacs/minimatch@85646c8f2739fdb0bc3b744606117a9d63f97c74^^^ commit making the fix

minimatch 6.2.1:

• isaacs/minimatch@8ce798c tagged release
• isaacs/minimatch@8ce798c2023dfda846bcd236b9121118d3278b73^^^ commit making the fix

minimatch 7.4.7:

• isaacs/minimatch@926c312 tagged release
• isaacs/minimatch@926c3129f46c428fdf651bbe73ca906fe8b42307^^^ commit making the fix

minimatch 8.0.5:

• isaacs/minimatch@f4ce011 tagged release
• isaacs/minimatch@f4ce011fce4be95c6af74182a772c92df83e6722^^^ commit making the fix

minimatch 9.0.6:

• isaacs/minimatch@7117ef3 tagged release
• isaacs/minimatch@7117ef381e74deace1c62a74d2298c8fe61d10ca^^^^^ commit making the fix

[github]

Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[jswalden]

...I have no idea why this is only here for the 3.* line but there is no similar thing for any of the other lines. I would guess the other lines need an equivalent of this, and maybe the Github wizard I was manipulating didn't work right when I filed the bug? 🤷

[jswalden]

Never mind, found #7002