René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Update minimatch in deps","articleBody":"### Version\r\n\r\nHEAD\r\n\r\n### Platform\r\n\r\nany\r\n\r\n### Subsystem\r\n\r\n_No response_\r\n\r\n### What steps will reproduce the bug?\r\n\r\nRight now the `minimatch` dependency that is vendored into the `deps` directory is at version `3.0.4`:\r\n\r\n```\r\ngrep '\"version\"' deps/npm/node_modules/minimatch/package.json\r\n  \"version\": \"3.0.4\",\r\n```\r\n\r\nUnfortunately that version is reported as vulnerable to a redos attack:\r\n```\r\n     Description : minimatch package versions before 3.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS). It\\'s possible to cause a\r\n       denial of service when calling function braceExpand (The regex /\\\\{.*\\\\}/ is vulnerable and can be exploited).\r\n```\r\n\r\nThe last npm update PR in #42039 did not (automatically) raise the minimatch dependency.\r\n\r\nCould you please update `minimatch` in v17 and v16 and release new versions?\r\n\r\n### How often does it reproduce? Is there a required condition?\r\n\r\nalways\r\n\r\n### What is the expected behavior?\r\n\r\nMinimatch is updated to at least version `3.0.5`.\r\n\r\n### What do you see instead?\r\n\r\nMinimatch is at `3.0.4`.\r\n\r\n### Additional information\r\n\r\n_No response_","author":{"url":"https://github.com/gjasny","@type":"Person","name":"gjasny"},"datePublished":"2022-02-22T09:16:00Z","url":"https://github.com/nodejs/node/issues/42075"}