@keystatic/core declares minimatch: ^9.0.3 (packages/keystatic/package.json), which resolves brace-expansion@2.1.2. GHSA-mh99-v99m-4gvg (CVE-2026-14257, high, CVSS 7.5, memory-exhaustion DoS in expand()) covers brace-expansion <=5.0.7 with the only patch on 5.0.8 — no fix has been backported to the 2.x line, so npm audit --audit-level=high fails for @keystatic/core consumers (reproduced directly: a minimal minimatch@^9.0.3 install resolves 2.1.2 and trips this exact advisory).
minimatch@10.x depends on brace-expansion@^5.0.5, resolving the patched 5.0.8 (verified: 0 vulnerabilities after the bump). Note the bump narrows the effective Node engine floor to 20 || >=22 — brace-expansion@5.0.8 and balanced-match@4.x don't support Node 18, even though minimatch itself still lists it.
We've verified @keystatic/core 0.6.2 builds, passes CMS validation, and the admin UI (incl. the path-reference field, the one minimatch call site) works under an npm override forcing minimatch 10.2.5. Happy to open a PR.
@keystatic/coredeclaresminimatch: ^9.0.3(packages/keystatic/package.json), which resolvesbrace-expansion@2.1.2. GHSA-mh99-v99m-4gvg (CVE-2026-14257, high, CVSS 7.5, memory-exhaustion DoS inexpand()) covers brace-expansion<=5.0.7with the only patch on 5.0.8 — no fix has been backported to the 2.x line, sonpm audit --audit-level=highfails for@keystatic/coreconsumers (reproduced directly: a minimalminimatch@^9.0.3install resolves 2.1.2 and trips this exact advisory).minimatch@10.xdepends onbrace-expansion@^5.0.5, resolving the patched 5.0.8 (verified: 0 vulnerabilities after the bump). Note the bump narrows the effective Node engine floor to 20 || >=22 —brace-expansion@5.0.8andbalanced-match@4.xdon't support Node 18, even though minimatch itself still lists it.We've verified
@keystatic/core0.6.2 builds, passes CMS validation, and the admin UI (incl. the path-reference field, the one minimatch call site) works under an npm override forcing minimatch 10.2.5. Happy to open a PR.