minimatch 11.0.0 regressed since 10.2.6 😞
🔴 40% heavier to install
🔴 40% heavier to install
minimatch - npmx
a glob matcher in javascript
npmx.dev
October 27, 2026 at 9:34 PM
minimatch 11.0.0 regressed since 10.2.6 😞
🔴 40% heavier to install
🔴 40% heavier to install
🚨 New MEDIUM CVE detected in AWS Lambda 🚨
CVE-2026-118764 impacts minimatch in 4 Lambda base images.
Details: https://github.com/aws/aws-lambda-base-images/issues/790
More: https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless
October 31, 2026 at 12:01 PM
🚨 New MEDIUM CVE detected in AWS Lambda 🚨
CVE-2026-118764 impacts minimatch in 4 Lambda base images.
Details: https://github.com/aws/aws-lambda-base-images/issues/790
More: https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless
🚨 EUVD-2026-113273
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
October 29, 2026 at 6:04 PM
🚨 EUVD-2026-113273
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
CloudSEK Traces 85 npm Typosquats to Infrastructure Hosting a GPU Attack Framework Targeting vast.ai
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
CloudSEK Traces 85 npm Typosquats to Infrastructure Hosting a GPU Attack Framework Targeting vast.ai
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting the vast.ai marketplace. In Part 1, CloudSEK researchers found that a single npm account, @prime0, published 85 typosquatted packages in just over three minutes, targeting 29 of the ecosystem's most widely downloaded libraries, including chalk, semver, debug, minimatch and ajv.
itnerd.blog
September 29, 2026 at 12:44 PM
CloudSEK Traces 85 npm Typosquats to Infrastructure Hosting a GPU Attack Framework Targeting vast.ai
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
An AI wrote (a+)+$ in half a second. That shape hung Cloudflare's whole network for 27 minutes in 2019, and it's already landed CVEs in ajv and minimatch. Semgrep catches it before merge. Copper Sun Brass bundles it as one of 12 scanners.
Read more → https://brss.fyi/1f4d
Read more → https://brss.fyi/1f4d
Will Your AI Write A Regex That Hangs Your Server?
Catastrophic backtracking turns one crafted input into a denial-of-service attack: real npm advisories and how to catch it before it ships.
brss.fyi
September 5, 2026 at 11:00 PM
An AI wrote (a+)+$ in half a second. That shape hung Cloudflare's whole network for 27 minutes in 2019, and it's already landed CVEs in ajv and minimatch. Semgrep catches it before merge. Copper Sun Brass bundles it as one of 12 scanners.
Read more → https://brss.fyi/1f4d
Read more → https://brss.fyi/1f4d
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 3.1.5 (#84)
August 11, 2026 at 6:50 PM
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 3.1.5 (#84)
Overcame most of the library differences already.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
March 10, 2026 at 7:17 AM
Overcame most of the library differences already.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
Speaking of "e18e", I am currently having issues helping `mocha` dropping `node-glob`: the integration tests are failing on Windows. Any help?
github.com/mochajs/moch...
github.com/mochajs/moch...
March 9, 2026 at 3:49 PM
Speaking of "e18e", I am currently having issues helping `mocha` dropping `node-glob`: the integration tests are failing on Windows. Any help?
github.com/mochajs/moch...
github.com/mochajs/moch...
🟠 CVE-2026-27904 - High (7.5)
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27904/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27904/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
February 26, 2026 at 5:39 AM
🟠 CVE-2026-27904 - High (7.5)
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27904/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27904/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
🟠 CVE-2026-27903 - High (7.5)
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27903/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27903/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
February 26, 2026 at 5:39 AM
🟠 CVE-2026-27903 - High (7.5)
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27903/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-27903/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
🟠 CVE-2026-26996 - High (7.5)
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-26996/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-26996/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
February 20, 2026 at 7:14 PM
🟠 CVE-2026-26996 - High (7.5)
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-26996/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp ob...
https://www.thehackerwire.com/vulnerability/CVE-2026-26996/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
We dropped support for sorting attributes in non-standard syntaxes like Vue, Svelte, and Astro. These rules were moved to the respective ESLint plugins for those frameworks.
We replaced Minimatch with plain regular expressions for creating custom sorting groups.
We replaced Minimatch with plain regular expressions for creating custom sorting groups.
November 19, 2024 at 12:43 PM
We dropped support for sorting attributes in non-standard syntaxes like Vue, Svelte, and Astro. These rules were moved to the respective ESLint plugins for those frameworks.
We replaced Minimatch with plain regular expressions for creating custom sorting groups.
We replaced Minimatch with plain regular expressions for creating custom sorting groups.
has the minimatch API *really* changed in incompatible ways that many times?!
June 8, 2026 at 4:01 AM
has the minimatch API *really* changed in incompatible ways that many times?!
not required for ruby, but for JS: library maintainers, bump your major version as infrequently as possible (so applications like ours don't end up with 8 distinct versions of minimatch and its brace-expansion dep)
June 8, 2026 at 3:59 AM
not required for ruby, but for JS: library maintainers, bump your major version as infrequently as possible (so applications like ours don't end up with 8 distinct versions of minimatch and its brace-expansion dep)
It'd be a pretty neat flex for minimatch to be the only pattern matching library on npm that is actually impossible to ReDoS.
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
Programming Techniques: Regular expression search algorithm
You have to enable JavaScript in your browser's settings in order to use the eReader.
dl.acm.org
March 4, 2026 at 6:07 AM
It'd be a pretty neat flex for minimatch to be the only pattern matching library on npm that is actually impossible to ReDoS.
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
That may be true but I doubt if it's realistic for one vendor to patch thousands of these modules, each tailored to their specific way of working, and even if they do how do they present all these info to users without swamping, especially for utility functions like tslib_1.__assign or minimatch
February 15, 2025 at 3:18 PM
That may be true but I doubt if it's realistic for one vendor to patch thousands of these modules, each tailored to their specific way of working, and even if they do how do they present all these info to users without swamping, especially for utility functions like tslib_1.__assign or minimatch
I think this is very much scoped to packages that matters for APM right? (Mostly, packages that involve some kind of remote I/O). Like looking at the high impact dual packages github.com/wooorm/npm-e... I doubt an APM vendor would care about/already be patching tslib or minimatch
github.com
February 15, 2025 at 3:07 PM
I think this is very much scoped to packages that matters for APM right? (Mostly, packages that involve some kind of remote I/O). Like looking at the high impact dual packages github.com/wooorm/npm-e... I doubt an APM vendor would care about/already be patching tslib or minimatch
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 9.0.9 (#62)
May 15, 2026 at 12:43 PM
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 9.0.9 (#62)
isaacs minimatch <10.2.1 hit by HIGH severity ReDoS (CVE-2026-26996) — user input can trigger hangs. Upgrade to 10.2.1+ & sanitize input. More: https://radar.offseq.com/threat/cve-2026-26996-cwe-1333-inefficient-regular-expres-e16ebdd4 #OffSeq #NodeJS #ReDoS
CVE-2026-26996: CWE-1333: Inefficient Regular Expression Complexity in isaacs mi
The vulnerability CVE-2026-26996 affects the isaacs minimatch library, a utility that converts glob expressions into JavaScript regular expressions. Versions 10.2.0 and earlier are susceptible to a Regular Expression Denial of Service (ReDo
radar.offseq.com
February 20, 2026 at 7:30 AM
isaacs minimatch <10.2.1 hit by HIGH severity ReDoS (CVE-2026-26996) — user input can trigger hangs. Upgrade to 10.2.1+ & sanitize input. More: https://radar.offseq.com/threat/cve-2026-26996-cwe-1333-inefficient-regular-expres-e16ebdd4 #OffSeq #NodeJS #ReDoS
tu vois un jeu qui t’intéresse ? Il a 5€ à récupérer sur Franconville
(Sauf book of time a 10€)
(Sauf book of time a 10€)
December 3, 2024 at 7:55 AM
tu vois un jeu qui t’intéresse ? Il a 5€ à récupérer sur Franconville
(Sauf book of time a 10€)
(Sauf book of time a 10€)
Update dependency `minimatch` (ClearlyClaire)
https://github.com/mastodon/mastodon/pull/38869
https://github.com/mastodon/mastodon/pull/38869
Update dependency `minimatch` by ClearlyClaire · Pull Request #38869 · mastodon/mastodon
Supersedes #38710
github.com
April 30, 2026 at 4:37 PM
Update dependency `minimatch` (ClearlyClaire)
https://github.com/mastodon/mastodon/pull/38869
https://github.com/mastodon/mastodon/pull/38869