Repository navigation
Fix Minimatch and Elliptic Dependabot update failures - #407
Merged
Vladimir Morozov (vmoroz) merged 1 commit intoNov 7, 2026
Merged
Vladimir Morozov (vmoroz) merged 1 commit into
Vladimir Morozov (vmoroz) merged 1 commit into
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Vladimir Morozov (vmoroz)
added
the
dependencies
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are identified for the dependency and build-tool updates.
No open issues 🎉
What changed in this PR
This PR addresses Dependabot update failures in Hermes parser tooling and the widgets benchmark without changing native engine code or committed benchmark bundles.
Changes:
- Aligns modern Glob consumers with Glob 14 and patched Minimatch 11.0.3, leaving legacy Minimatch callers unchanged.
- Adds regression tests for wildcard file discovery and coverage exclusions.
- Upgrades the widgets build to Webpack 5, removing the Elliptic dependency chain while preserving the output location and ES5 runtime target.
| File | Description |
|---|---|
| tools/hermes-parser/js/yarn.lock | Locks updated Glob and Minimatch dependencies and removes obsolete transitive packages. |
| tools/hermes-parser/js/package.json | Adds targeted Glob and Minimatch resolutions. |
| tools/hermes-parser/js/__tests__/tooling-glob-test.js | Tests Jest and coverage file discovery with the updated dependencies. |
| benchmarks/widgets/original/es5/webpack.config.js | Sets the ES5 runtime target, preserves the output directory, and updates source-map configuration. |
| benchmarks/widgets/original/es5/package.json | Upgrades Webpack and its CLI and updates the build command. |
| benchmarks/widgets/original/es5/package-lock.json | Locks the upgraded build tools and removes the browser-crypto chain containing Elliptic. |
Review effort: Balanced
Benchmark ResultsTotal benchmarks: 204 Inputs: baseline/baseline.json, bench_result.json v8 (6176ms, 5214ms) -15.6%
test-suites (317886ms, 240139ms) -24.5%
micros (60876ms, 58639ms) -3.7%
jit-benches (8563ms, 5927ms) -30.8%
many-subclasses (73437ms, 57045ms) -22.3%
map-objects (3627ms, 2841ms) -21.7%
map-strings (4335ms, 3699ms) -14.7%
nbody (3448ms, 2243ms) -35.0%
string-switch (6503ms, 5535ms) -14.9%
raytracer (5608ms, 4548ms) -18.9%
MiniReact (30332ms, 25120ms) -17.2%
widgets (12934ms, 10077ms) -22.1%
|
Vladimir Morozov (vmoroz)
enabled auto-merge (squash)
November 7, 2026 03:08
Danny van Velzen (dannyvv)
approved these changes
Nov 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Registry access is fixed, but this Dependabot security update
still cannot update Minimatch or Elliptic.
patched matcher still discovers files. Keep legacy 3.x/5.x callers unchanged
and add wildcard-discovery regression tests.
obsolete browser-crypto dependency chain that brings in unpatched Elliptic.
Preserve the output location and ES5 runtime target.
Deepmerge has no patched release and is unchanged. Registry configuration,
eight-day gates, README files, and the pre-generated benchmark bundle/map are
also unchanged.
Test Plan
Local validation with the documented anonymous PackageFeedProxy environment:
.\dev npm-source-lint: passed, 12 projects, 0 violations.node --test --test-reporter=dot .\.ado\scripts\npm-source-lint.test.ts: passed, 54 tests.node .\.yarn\releases\yarn-4.13.0.cjs --cwd .\tools\hermes-parser\js install --immutable: passed.node .\.yarn\releases\yarn-4.13.0.cjs --cwd .\tools\hermes-parser\js test --runInBand --runTestsByPath .\__tests__\tooling-glob-test.js .\hermes-parser\__tests__\getModuleDocblock-test.js --coverage --collectCoverageFrom=hermes-parser/src/getModuleDocblock.js --coverageReporters=text-summary: passed, 2 suites, 9 tests.npm --prefix .\benchmarks\widgets\original\es5 ci --no-audit --no-fund: passed, cold restore.npm --prefix .\benchmarks\widgets\original\es5 run build -- --stats=errors-warnings: passed.node .\.ado\scripts\node_modules\prettier\bin\prettier.cjs --check .\tools\hermes-parser\js\__tests__\tooling-glob-test.js: passed.Additional local checks passed for all four affected Minimatch consumers,
legacy callers, and identical scene-diff output from the regenerated and
committed bundles after 5,000 iterations each.
The hermes-parser Jest checks are local; CI does not currently run that suite.
The full parser suite was not run because the generated WASM parser fixture is
absent. Native build was not run; no native code changed.
Microsoft Reviewers: Open in CodeFlow