GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Replace `multimatch` with `minimatch@11` to resolve GHSA-g3hv-75wg-m249 by jeremy-morren · Pull Request #1469 · javascript-obfuscator/javascript-obfuscator

Conversation

@jeremy-morren

@jeremy-morren jeremy-morren commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

[email protected] pulls in minimatch@3, which is vulnerable to GHSA-g3hv-75wg-m249 (fixed only in 11.0.1). Bumping multimatch doesn't help: 6+ is ESM-only (#1340) and 8.0.0 still uses minimatch@10. A resolutions entry doesn't help either, because consumers ignore it.

  • --exclude now uses minimatch directly. Patterns still apply in order with ! negation, and \ still works as a separator on Windows.
  • Added tests for negated and non-globstar patterns.
  • Removed the obsolete brace-expansion resolution.
  • engines.node is now >=20: minimatch 11 needs Node 20, Node 18 is EOL, and CI already tests only 20, 22 and 24.

The risk is low (it needs a malicious --exclude pattern), but this clears the audit warning for downstream users.

Fixes #1468.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
jeremy-morren and others added 2 commits November 2, 2026 11:40
@jeremy-morren @claude
Replaced multimatch with minimatch@11, resolving `GHSA-g3hv-75wg-…
23cfbb7 
…m249`

`[email protected]` depends on `minimatch@^3`, and every `minimatch` below
11.0.1 is affected by GHSA-g3hv-75wg-m249. Newer `multimatch` versions are
ESM-only and still use a vulnerable `minimatch`, so the CLI `--exclude`
option now uses `minimatch` directly, keeping multimatch's ordered
`!`-negation semantics and its Windows `\` separator handling.

`minimatch@11` requires Node.js 20, so `engines.node` is now `>=20.0.0`.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@sanex3339 @claude
Bumped version to 5.10.0 and the documented Node requirement to 20
d77144b 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sanex3339
sanex3339 reviewed Nov 4, 2026
View reviewed changes
Comment thread CHANGELOG.md
Comment on lines +3 to +6
v5.10.0
---
* Replaced `multimatch` with `minimatch@11` for the CLI `--exclude` option, resolving the `minimatch` denial of service advisory `GHSA-g3hv-75wg-m249`
* Require Node.js 20 or newer, as `minimatch@11` does

@sanex3339 sanex3339 Nov 4, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically it's a breaking change, but Node 20 is already EOL'ed + it fixes a scanner issue, so it is done as a minor version

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sanex3339

sanex3339 commented Nov 4, 2026

Copy link
Copy Markdown
Member

@jeremy-morren thank you
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sanex3339
sanex3339 merged commit 28cd8f7 into javascript-obfuscator:master Nov 4, 2026
7 checks passed

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sanex3339 sanex3339 sanex3339 left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

npm audit: minimatch < 11.0.1 (GHSA-g3hv-75wg-m249) via [email protected]: fix needs Node 20

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@jeremy-morren @sanex3339
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.