Update minimatch dependency

[edlerd]

The package currently depends on minimatch@3.1.2, which is dependant on brace-expansion@"^1.1.7" . This version of brace expansion comes with a security issue, that has since been fixed. An updated version of minimatch is available as well.

Please update the dependency minimatch.

[lumirlumir]

Hi @edlerd — thanks for filing the issue.

However, this package is frozen except for critical bug fixes while ESLint transitions to a new config system.

You can find more references in the following links:

• ajv update: update ajv #205 (comment)
• globals update: Dependency on older globals package. #201 (comment), Update globals dependency to ^15.0.0 #167 (comment)

---

Just in case, let’s see what other team members think: @eslint/eslint-team

[mdjermanovic]

We can't switch to minimatch v10 as that would cause breaking changes for users of this package, which is, as @lumirlumir noted, frozen except for critical bug fixes.

The security issue is fixed in brace-expansion v1.1.12, which is in range of ^1.1.7, so you can update your lockfile to use brace-expansion v1.1.12.