chore(deps): bump `minimatch` to `11.0.1` in `package-lock.json` (1 advisory)

Open Beginner friendly
  • Is something wrong?
#5,481 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
devops, security

Research direction

Read src/filesystem/package.json and update the declared minimatch range while keeping its existing operator. Then inspect package-lock.json to confirm every locked copy is outside the advisory’s vulnerable range, and run node scripts/dependabot-alerts.mjs --dry-run; the issue is done when the script reports the exposure cleared.

Written by the indexing model from the issue text.

Description

chore dependencies server-filesystem v2

Filed automatically from 1 open Dependabot alert by the daily alert sweep (#4874). The fix is written by hand against v2/main.
Package minimatch (npm)
Manifest package-lock.json
Vulnerable on v2/main 10.2.5
Bump to 11.0.1: the lowest listed patched version that no range below covers
Scope development
Highest severity medium

Advisories

GHSA CVE Severity Vulnerable range Fixed in Summary
GHSA-g3hv-75wg-m249 CVE-2026-118764 medium >= 7.0.0, < 11.0.1 11.0.1 minimatch has potential denial of service via globparts amplification

Fix

Raise the declared range in src/filesystem/package.json so minimatch can no longer resolve below 11.0.1, keeping the operator each already uses.

Then verify before opening the PR: every locked copy must be outside every range in the Advisories table. node scripts/dependabot-alerts.mjs --dry-run against the branch should report this exposure cleared.

Vulnerable copy Version
node_modules/minimatch 10.2.5

[!NOTE]
The GHSA, CVE, severity, range and summary are the advisory's own, as Dependabot reports them. What this sweep verified against v2/main is the installed versions and whether each advisory's range still matches them: GitHub computes alerts from the default branch, so an alert is filed only after that re-check.

Dominant language
TypeScript
Stars
91.7k
Forks
11.9k
Avg merge
3h 30m
Merged PRs (30d)
204

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/servers

All issues in modelcontextprotocol/servers

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.