Update minimatch to avoid vulnerable brace-expansion version

Open Beginner friendly
#9 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
security, tooling

Research direction

Start at package.json line 29 and inspect the minimatch dependency and its resolved brace-expansion version. Update minimatch so it no longer resolves to the vulnerable brace-expansion version, then verify the dependency tree no longer reports CVE-2026-14257.

Written by the indexing model from the issue text.

Description

https://github.com/bcoe/dotgitignore/blob/13e96d88caba0291aaa7b3fbcb0d6b7c73cf57eb/package.json#L29

Minimatch ^3.0.4 resolves for me to 3.1.5 which references brace-expansion 1.1.6

Which is affected by CVE-2026-14257.

I know that the library is likely not used in a vulnerable way, but it would be nice, if you could update your library in order to avoid the CVE warnings downstream.

Dominant language
JavaScript
Stars
7
Forks
5
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from bcoe/dotgitignore

All issues in bcoe/dotgitignore

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.