Repository navigation
minimatch アラート対応: jest 30 へ更新し minimatch を ^11 に固定 - #55
Merged
Merged
Conversation
…atch to ^11 Alert #77 (GHSA-g3hv-75wg-m249): minimatch < 11.0.1, patched in 11.0.1. The tree carried minimatch 3.1.5 (eslint/test-exclude chains) and 10.2.5 (typescript-estree). No parent package resolves to >= 11 yet (latest eslint 10 still uses ^10), so minimatch is pinned via overrides. A plain override breaks jest --coverage on jest 29: test-exclude 6 calls minimatch as a function, which v11 no longer supports. Upgrading jest and babel-jest to ^30 replaces it with test-exclude 7, which uses the named export and works with minimatch 11. Verified: npm ls minimatch shows 11.0.4 everywhere; npm test (incl. lint/format pretest), test:mjs, and jest --coverage for both configs all pass. sprintf-js stays out of the tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot アラート #77（GHSA-g3hv-75wg-m249、minimatch < 11.0.1、修正版 11.0.1）への対応です。
ツリーには minimatch 3.1.5（eslint / test-exclude 経由）と 10.2.5（typescript-estree 経由）がありました。親パッケージ側では最新版でも ^10 止まり（eslint 10 でも ^10.2.6）のため、
overridesで ^11.0.4 に固定しています。単純に override すると jest 29 では
jest --coverageが壊れます（test-exclude 6 が minimatch を関数として呼ぶ旧API依存で、v11 では動作しない）。そのため jest と babel-jest を ^30 に上げ、test-exclude 7（名前付き export 使用）に入れ替えています。検証済み:
npm ls minimatch: 全て 11.0.4npm test（pretest の lint / format check 含む）、npm run test:mjs: 通過jest --coverage（js / mjs 両 config）: 通過なお deepmerge のアラート #76 は、修正版が存在しない（最新 4.3.1 自体が対象、jest-config 30 でも ^4.3.1 のまま）ため、このPRには含めていません。