Repository navigation
Update dependency brace-expansion@<1.1.21 to v5 - #762
renovate[bot] wants to merge 1 commit into
Conversation
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| # Security: force patched versions of transitive deps that parents pin to vulnerable versions. | ||
| overrides: | ||
| brace-expansion@<1.1.21: ^1.1.21 | ||
| brace-expansion@<1.1.21: ^5.0.0 |
There was a problem hiding this comment.
🔴 Legacy glob matching fails across tooling
With brace-expansion forced to v5, minimatch@3.1.5 cannot call its ESM-only dependency as a CommonJS function. ESLint and glob 7 fail to match files, breaking workspace linting.
Learn more
The lockfile links minimatch@3.1.5 to brace-expansion 5.0.12. That minimatch release loads brace-expansion with require() and invokes the returned value as a function. Brace-expansion changed to ESM in v3, so the 5.x export is not the callable CommonJS value minimatch expects. ESLint and glob 7 both depend on minimatch 3. Linting files with brace patterns and legacy glob calls fail; on Node versions that cannot require ESM, loading minimatch itself fails.
Example: Running pnpm lint on Node 24 processes an ESLint glob such as **/*.{ts,tsx}. Minimatch 3 invokes the ESM namespace as a function instead of expanding the braces, so the lint run fails.
Recommended fix: Keep the override for 1.x consumers on patched brace-expansion 1.1.21, or update all consumers of minimatch 3 to releases compatible with brace-expansion 5 before overriding their dependency. Test lint and glob matching under the repository's supported Node versions.
Was this helpful? React with 👍 or 👎 to provide feedback.
This PR contains the following updates:
^1.1.21→^5.0.0Release Notes
juliangruber/brace-expansion (brace-expansion@<1.1.21)
v5.0.12Compare Source
v5.0.11Compare Source
v5.0.10Compare Source
v5.0.9Compare Source
v5.0.8Compare Source
v5.0.7Compare Source
v5.0.6Compare Source
v5.0.5Compare Source
v5.0.4Compare Source
v5.0.3Compare Source
v5.0.2Compare Source
v4.0.1Compare Source
5a5cc170b6a978v4.0.0Compare Source
278132bdd72a59tea.yaml70e4c1bAs a precaution to not risk breaking anything with
278132b, this is a new semver major releasev3.0.9Compare Source
v3.0.8Compare Source
v3.0.7Compare Source
v3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
3059c078229e6f15f9b3cv3.0.0Compare Source
c0360e868c0e379e781e93494c4ddd5a4cb6dad209teste3dd8aed23ede91eb3fa41e7c9cd252053761a94f1dc741cf8ee56265c8756a05978a7v2.1.7Compare Source
v2.1.6Compare Source
v2.1.5Compare Source
v2.1.4Compare Source
v2.1.3Compare Source
v2.1.2Compare Source
v2.1.1Compare Source
c3a817cv2.1.0Compare Source
v2.0.3Compare Source
v2.0.2Compare Source
14f1d91ed7780a36603d5v2.0.1Compare Source
v2.0.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.