Skip to content

@actions/glob: bump minimatch from v3.0.4 to v10.2.4 #2355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shogo82148 wants to merge 3 commits into
base: main
Choose a base branch
from
+39 −32
Open

@actions/glob: bump minimatch from v3.0.4 to v10.2.4 #2355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6bd5e50
@actions/glob: bump minimatch from v3.0.4 to v10.2.4
shogo82148 Mar 20, 2026
20647b6
@actions/core: update regression test with minimatch v3
shogo82148 Mar 20, 2026
74fcfdb
@actions/glob: add some comments for the regression testing
shogo82148 Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions packages/glob/__tests__/internal-pattern.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,7 +303,7 @@ describe('pattern', () => {
expect(pattern.match(`${root}foo/bar/baz`)).toBeFalsy()
pattern = new Pattern(`${root}foo/b[!]r/b*`)
expect(pattern.searchPath).toBe(`${root}foo${path.sep}b!r`)
expect(pattern.match(`${root}foo/b!r/baz`)).toBeTruthy()
expect(pattern.match(`${root}foo/b!r/baz`)).toBeFalsy()
pattern = new Pattern(`${root}foo/b[[]ar/b*`)
expect(pattern.searchPath).toBe(`${root}foo${path.sep}b[ar`)
expect(pattern.match(`${root}foo/b[ar/baz`)).toBeTruthy()
Expand Down Expand Up @@ -340,9 +340,18 @@ describe('pattern', () => {
pattern = new Pattern('C:/foo/b\\[a]r/b*')
expect(pattern.searchPath).toBe(`C:\\foo\\b\\ar`)
expect(pattern.match('C:/foo/b/ar/baz')).toBeTruthy()

// Regression testing for minimatch v3
// Historically, minimatch/glob had a bug when parsing a character class
// containing an escaped '!' (e.g. `[\\!]`). In some cases, the internal
// pattern construction would incorrectly insert the literal string
// "undefined" into the generated pattern/segment, which could make a
// pattern intended to match `b[\\!]r` also match a path segment like
// `b[undefined/!]r`. This test ensures that a pattern with a literal
// `[\\!]` in the directory name does *not* match such malformed paths.
pattern = new Pattern('C:/foo/b[\\!]r/b*')
expect(pattern.searchPath).toBe('C:\\foo\\b[\\!]r')
expect(pattern.match('C:/foo/b[undefined/!]r/baz')).toBeTruthy() // Note, "undefined" substr to accommodate a bug in Minimatch when nocase=true
expect(pattern.match('C:/foo/b[undefined/!]r/baz')).toBeFalsy()
Copy link
Copy Markdown
Contributor Author

@shogo82148 shogo82148 Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is a bug of minimatch v3. toBeFalsy is correct.

}
})
})
Expand Down
46 changes: 24 additions & 22 deletions packages/glob/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/glob/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,6 @@
},
"dependencies": {
"@actions/core": "^3.0.0",
"minimatch": "^3.0.4"
"minimatch": "^10.2.4"
}
Comment on lines 46 to 49
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minimatch@10.2.4 declares engines: { node: "18 || 20 || >=22" } (see updated package-lock). @actions/glob currently doesn’t declare a compatible Node runtime in its own package.json, so consumers on older Node versions can install this package and then fail at runtime. Consider adding an explicit engines.node requirement (and/or documenting the minimum supported Node version) to make the breaking requirement visible during install.

Copilot uses AI. Check for mistakes.
}
10 changes: 3 additions & 7 deletions packages/glob/src/internal-pattern.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,10 @@ import * as os from 'os'
import * as path from 'path'
import * as pathHelper from './internal-path-helper.js'
import assert from 'assert'
import minimatch from 'minimatch'
import {Minimatch, type MinimatchOptions} from 'minimatch'
import {MatchKind} from './internal-match-kind.js'
import {Path} from './internal-path.js'

type IMinimatch = minimatch.IMinimatch
type IMinimatchOptions = minimatch.IOptions
const {Minimatch} = minimatch

const IS_WINDOWS = process.platform === 'win32'

export class Pattern {
Expand Down Expand Up @@ -38,7 +34,7 @@ export class Pattern {
/**
* The Minimatch object used for matching
*/
private readonly minimatch: IMinimatch
private readonly minimatch: Minimatch

/**
* Used to workaround a limitation with Minimatch when determining a partial
Expand Down Expand Up @@ -126,7 +122,7 @@ export class Pattern {
this.isImplicitPattern = isImplicitPattern

// Create minimatch
const minimatchOptions: IMinimatchOptions = {
const minimatchOptions: MinimatchOptions = {
dot: true,
nobrace: true,
nocase: IS_WINDOWS,
Expand Down