Skip to content

Conversation

@mkonikov
Copy link

@mkonikov mkonikov commented Nov 17, 2025

This PR updates the glob dependency to v10, which removes the dependency on the abandoned and vulnerable inflight package.

Glob 11 (the oldest non vulnerable version) updated the min required node version to 20, so made updates accordingly. Updated jest to recent version so tests will pass.

Workflows

Fixed the ci workflow that was trying to use a matrix for different node versions but was not actually using the intended node versions. Updated to checkout v4 at same time.

Associated Issues

Fixes #277
Fixes #429

@daniloab
Copy link
Collaborator

@mkonikov thanks for the PR! Can you help to fix the failed actions?

@mkonikov
Copy link
Author

@daniloab Updated the lock files. Should work now. Please rerun.

@daniloab
Copy link
Collaborator

daniloab commented Nov 18, 2025

@mkonikov would you mind check again audit and tests for 18x? Thanks for helping!

mkonikov and others added 3 commits November 18, 2025 09:52
* Fix node versions in ci matrix

* Update cli.spec.js.snap

* Update ci.yml
@mkonikov
Copy link
Author

@daniloab Fixed! (Needed to update Glob to v11 and other packages to pass audits)

@mkonikov
Copy link
Author

@daniloab Look good?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Module is not supported or leak memory vulnerability issue with inflight @1.0.6

2 participants