🚨 New MEDIUM CVE detected in AWS Lambda 🚨
CVE-2026-118764 impacts minimatch in 4 Lambda base images.
Details: https://github.com/aws/aws-lambda-base-images/issues/790
More: https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless
October 31, 2026 at 12:01 PM
🚨 New MEDIUM CVE detected in AWS Lambda 🚨
CVE-2026-118764 impacts minimatch in 4 Lambda base images.
Details: https://github.com/aws/aws-lambda-base-images/issues/790
More: https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless
🚨 EUVD-2026-113273
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
October 29, 2026 at 6:04 PM
🚨 EUVD-2026-113273
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
📊 8.7/10
🏢 isaacs
📝 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPha...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113273
#cybersecurity #infosec #cve #euvd
minimatch 11.0.0 regressed since 10.2.6 😞
🔴 40% heavier to install
🔴 40% heavier to install
minimatch - npmx
a glob matcher in javascript
npmx.dev
October 27, 2026 at 9:34 PM
minimatch 11.0.0 regressed since 10.2.6 😞
🔴 40% heavier to install
🔴 40% heavier to install
CloudSEK Traces 85 npm Typosquats to Infrastructure Hosting a GPU Attack Framework Targeting vast.ai
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
CloudSEK Traces 85 npm Typosquats to Infrastructure Hosting a GPU Attack Framework Targeting vast.ai
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting the vast.ai marketplace. In Part 1, CloudSEK researchers found that a single npm account, @prime0, published 85 typosquatted packages in just over three minutes, targeting 29 of the ecosystem's most widely downloaded libraries, including chalk, semver, debug, minimatch and ajv.
itnerd.blog
September 29, 2026 at 12:44 PM
CloudSEK Traces 85 npm Typosquats to Infrastructure Hosting a GPU Attack Framework Targeting vast.ai
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
CloudSEK is out with a two-part investigation — TOPHIT — uncovering a threat operation that connects a large-scale npm supply-chain campaign with an emerging GPU cryptojacking framework targeting…
An AI wrote (a+)+$ in half a second. That shape hung Cloudflare's whole network for 27 minutes in 2019, and it's already landed CVEs in ajv and minimatch. Semgrep catches it before merge. Copper Sun Brass bundles it as one of 12 scanners.
Read more → https://brss.fyi/1f4d
Read more → https://brss.fyi/1f4d
Will Your AI Write A Regex That Hangs Your Server?
Catastrophic backtracking turns one crafted input into a denial-of-service attack: real npm advisories and how to catch it before it ships.
brss.fyi
September 5, 2026 at 11:00 PM
An AI wrote (a+)+$ in half a second. That shape hung Cloudflare's whole network for 27 minutes in 2019, and it's already landed CVEs in ajv and minimatch. Semgrep catches it before merge. Copper Sun Brass bundles it as one of 12 scanners.
Read more → https://brss.fyi/1f4d
Read more → https://brss.fyi/1f4d
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 3.1.5 (#84)
August 11, 2026 at 6:50 PM
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 3.1.5 (#84)
has the minimatch API *really* changed in incompatible ways that many times?!
June 8, 2026 at 4:01 AM
has the minimatch API *really* changed in incompatible ways that many times?!
not required for ruby, but for JS: library maintainers, bump your major version as infrequently as possible (so applications like ours don't end up with 8 distinct versions of minimatch and its brace-expansion dep)
June 8, 2026 at 3:59 AM
not required for ruby, but for JS: library maintainers, bump your major version as infrequently as possible (so applications like ours don't end up with 8 distinct versions of minimatch and its brace-expansion dep)
Meant to link to this: github.com/11ty/elevent...
Release Eleventy v3.1.5: Dependable Dependencies · 11ty/eleventy
No Eleventy core code changes, this release is for minor version dependency updates on 3.x only
Fixes npm audit report for minimatch: #4239 via @11ty/recursive-copy@4.0.4
Upgrade liquidjs from 10....
github.com
May 19, 2026 at 9:24 PM
Meant to link to this: github.com/11ty/elevent...
I know a good chunk of us remember fusion fall,
But does anyone remember minimatch? Cartoon network's older MMO
But does anyone remember minimatch? Cartoon network's older MMO
May 16, 2026 at 6:09 AM
I know a good chunk of us remember fusion fall,
But does anyone remember minimatch? Cartoon network's older MMO
But does anyone remember minimatch? Cartoon network's older MMO
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 9.0.9 (#62)
May 15, 2026 at 12:43 PM
Merged PR into main at bluesky-social/react-native-uitextview: chore(deps): bump minimatch from 3.1.2 to 9.0.9 (#62)
Parts 1-2/2 — EFTA01219823.jpg
#epsteinweb #efta01219823
https://epsteinweb.org
Available in the iOS app store now!
https://apps.apple.com/us/app/epstein-web/id6758880661
#epsteinweb #efta01219823
https://epsteinweb.org
Available in the iOS app store now!
https://apps.apple.com/us/app/epstein-web/id6758880661
May 13, 2026 at 6:53 PM
Parts 1-2/2 — EFTA01219823.jpg
#epsteinweb #efta01219823
https://epsteinweb.org
Available in the iOS app store now!
https://apps.apple.com/us/app/epstein-web/id6758880661
#epsteinweb #efta01219823
https://epsteinweb.org
Available in the iOS app store now!
https://apps.apple.com/us/app/epstein-web/id6758880661
new version of eslint-plugin-lit 🎉 it has a new rule for preferring `@querySelector` decorator and friends
Release 2.3.0 · 43081j/eslint-plugin-lit
What's Changed
build(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in #231
build(deps-dev): bump minimatch from 3.1.2 to 3.1.5 by @dependabot[bot] in #235
build(...
github.com
May 11, 2026 at 5:40 PM
new version of eslint-plugin-lit 🎉 it has a new rule for preferring `@querySelector` decorator and friends
Do you think nested *() extglobs generate catastrophically backtracking regular expressions in minimatch 3.1.2 or not really
May 6, 2026 at 8:55 PM
Do you think nested *() extglobs generate catastrophically backtracking regular expressions in minimatch 3.1.2 or not really
Update dependency `minimatch` (ClearlyClaire)
https://github.com/mastodon/mastodon/pull/38869
https://github.com/mastodon/mastodon/pull/38869
Update dependency `minimatch` by ClearlyClaire · Pull Request #38869 · mastodon/mastodon
Supersedes #38710
github.com
April 30, 2026 at 4:37 PM
Update dependency `minimatch` (ClearlyClaire)
https://github.com/mastodon/mastodon/pull/38869
https://github.com/mastodon/mastodon/pull/38869
A new AI review! villesau/ai-codereviewer ⭐3.1/5.0
AI Code Reviewer is a compact GitHub Action written in TypeScript that pulls a PR diff via Octokit, parses it with parse-diff, filters paths with minimatch, and sends chunks to the OpenAI API to gener...
https://gitrated.com/villesau/ai-codereviewer
AI Code Reviewer is a compact GitHub Action written in TypeScript that pulls a PR diff via Octokit, parses it with parse-diff, filters paths with minimatch, and sends chunks to the OpenAI API to gener...
https://gitrated.com/villesau/ai-codereviewer
April 20, 2026 at 7:53 PM
A new AI review! villesau/ai-codereviewer ⭐3.1/5.0
AI Code Reviewer is a compact GitHub Action written in TypeScript that pulls a PR diff via Octokit, parses it with parse-diff, filters paths with minimatch, and sends chunks to the OpenAI API to gener...
https://gitrated.com/villesau/ai-codereviewer
AI Code Reviewer is a compact GitHub Action written in TypeScript that pulls a PR diff via Octokit, parses it with parse-diff, filters paths with minimatch, and sends chunks to the OpenAI API to gener...
https://gitrated.com/villesau/ai-codereviewer
Out now: Eleventy (core) v3.1.5, solely an update to our downstream dependencies.
github.com/11ty/elevent...
github.com/11ty/elevent...
Release Eleventy v3.1.5: Dependable Dependencies · 11ty/eleventy
No Eleventy core code changes, this release is for minor version dependency updates on 3.x only
Fixes npm audit report for minimatch: #4239 via @11ty/recursive-copy@4.0.4
Upgrade liquidjs from 10....
github.com
March 18, 2026 at 9:10 PM
Out now: Eleventy (core) v3.1.5, solely an update to our downstream dependencies.
github.com/11ty/elevent...
github.com/11ty/elevent...
if it's only failing on windows then pretty much the only thing that could fail is that windows style paths are being used somewhere i think? that pr doesnt just replace glob but also minimatch. hope this helps 👍
March 10, 2026 at 10:22 PM
if it's only failing on windows then pretty much the only thing that could fail is that windows style paths are being used somewhere i think? that pr doesnt just replace glob but also minimatch. hope this helps 👍
Overcame most of the library differences already.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
March 10, 2026 at 7:17 AM
Overcame most of the library differences already.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
Right now, the only gap is behavior differences on Windows. Maybe has something to do with picomatch vs minimatch, not necessarily tinyglobby here.
Speaking of "e18e", I am currently having issues helping `mocha` dropping `node-glob`: the integration tests are failing on Windows. Any help?
github.com/mochajs/moch...
github.com/mochajs/moch...
March 9, 2026 at 3:49 PM
Speaking of "e18e", I am currently having issues helping `mocha` dropping `node-glob`: the integration tests are failing on Windows. Any help?
github.com/mochajs/moch...
github.com/mochajs/moch...
It'd be a pretty neat flex for minimatch to be the only pattern matching library on npm that is actually impossible to ReDoS.
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
Programming Techniques: Regular expression search algorithm
You have to enable JavaScript in your browser's settings in order to use the eReader.
dl.acm.org
March 4, 2026 at 6:07 AM
It'd be a pretty neat flex for minimatch to be the only pattern matching library on npm that is actually impossible to ReDoS.
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....
The algorithm is similar to the NFA algorithm from Ken Thompson's 1968 paper dl.acm.org/doi/epdf/10....