[polylane]

The Dependabot security-update job for minimatch kept failing, so the known-vulnerable copies of the package stayed in the lockfile and no patched version ever landed. The resolved dependency tree now carries a single patched minimatch, so the security update can complete and the job stops failing.

flowchart LR
  A["Dependabot security-update job"] --> B["resolves minimatch from package-lock.json"]
  B --> C["eslint and @eslint/* pin minmatch ^3.1.5"]
  B --> D["@typescript-eslint/typescript-estree pins ^10.2.2"]
  C --> E["patched 11.0.1 unreachable"]
  D --> E
  E --> F["security_update_not_possible, job fails"]
  G["fix: package.json overrides for minimatch"] -.-> B

Loading

Why this fix

Dependabot's security-update job (run 41536599089) reported security_update_not_possible. Three eslint-family packages pin minimatch to ranges that top out below the patched 11.0.1, so the resolver could only reach 10.2.5 while the earliest fixed version is 11.0.1, and the job failed. The override raises every minimatch copy in the tree to 11.0.x, so no vulnerable copy remains and the update can complete. The main risk is that minimatch 11 is a major jump; eslint and typescript-eslint use the CommonJS and named exports that 11 keeps, and lint runs clean against it. An unrelated @humanfs/node advisory is noted on the issue.

Fix walkthrough

Watch the fix explained (1:34). Recorded for commit 75bd2d8924fe8fa7d62d0932b510de64fdd77481.

Out of scope

• eslint and typescript-eslint: already at their latest resolved versions, so no version bump could raise minimatch.
• @humanfs/node 0.16.7: separate moderate advisory (GHSA-p498-v437-472g), recorded as a follow-up rather than bundled here.

Production impact

Check that the cli dev dependency tree carries no vulnerable minimatch

The change only touches the dependency manifest and lockfile of a public npm CLI repository; minimatch is a transitive dev dependency of eslint and typescript-eslint and is not on the shipped runtime path. The repository node code.repository:coreplanelabs/cli has no deploy edges, and a clean install, lint, test and build all pass on the new tree.

Checked and not affected (1)

• cli

Observability

• The changed path is the GitHub Actions Dependabot security-update job; its log reports security_update_not_possible when it fails and completes silently when it succeeds. No application telemetry is involved; minimatch is a dev-only dependency and the bundled CLI artifact is unchanged.

Polylane assessed this pull request at 75bd2d8.

Causal chain

• Signal (alert): GitHub Actions workflow "npm_and_yarn in /. for minimatch - Update #1675705304" run Install referral telemetry, README positioning, installer shim #6 concluded failure on main
• Surfacing site: coreplanelabs/cli at GitHub Actions run 41536599089 (Dependabot security-update job)
• Mechanism: Dependabot's security-update resolver read package-lock.json, saw the patched minimatch 11.0.1 unreachable because eslint and its shared packages declare minimatch ^3.1.5 and @typescript-eslint/typescript-estree declares ^10.2.2, and reported security_update_not_possible, so the job failed.
• Producer: coreplanelabs/cli dependency manifest, at coreplanelabs/cli:package.json#overrides
• Blast radius: 0 other resource(s), 0 other tenant(s); data at risk: none named
• Producer evidence:
  • Dependabot job log for run 41536599089 names blocking_dependencies: @eslint/config-array (minimatch ^3.1.5), @eslint/eslintrc (^3.1.5), @typescript-eslint/typescript-estree (^10.2.2), eslint (^3.1.5), and reports latest resolvable 10.2.5, earliest fixed 11.0.1.
  • package-lock.json held node_modules/minimatch 3.1.5 and node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch 10.2.5, both below the patched 11.0.1.
  • package.json had no overrides key, so the exact transitive ranges could not be raised.

2 files changed (+34/-61)

• package-lock.json: modified, +31/-61
• package.json: modified, +3/-0

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.