From c2f350932128e39b077b83089ea0b174a2f8f6c7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Feb 2026 02:50:32 +0000 Subject: [PATCH 1/3] Initial plan From c1c7fef431bd454a9591d24f6528236b4ad69e2b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Feb 2026 02:51:34 +0000 Subject: [PATCH 2/3] Add changelog entry for minimatch bump in webpack4-localization-plugin Co-authored-by: iclanton <5010588+iclanton@users.noreply.github.com> --- .../bump-minimatch_2026-02-20-02-51.json | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 common/changes/@rushstack/webpack4-localization-plugin/bump-minimatch_2026-02-20-02-51.json diff --git a/common/changes/@rushstack/webpack4-localization-plugin/bump-minimatch_2026-02-20-02-51.json b/common/changes/@rushstack/webpack4-localization-plugin/bump-minimatch_2026-02-20-02-51.json new file mode 100644 index 00000000000..3daa06207bb --- /dev/null +++ b/common/changes/@rushstack/webpack4-localization-plugin/bump-minimatch_2026-02-20-02-51.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "packageName": "@rushstack/webpack4-localization-plugin", + "comment": "Bump minimatch from 10.1.2 to 10.2.1", + "type": "patch" + } + ], + "packageName": "@rushstack/webpack4-localization-plugin" +} From 4d598f55cd42dc6d3e7232948ddf603016d5b1e1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Feb 2026 03:05:38 +0000 Subject: [PATCH 3/3] Run rush update and bump minimatch to 10.2.1 across all affected packages Co-authored-by: iclanton <5010588+iclanton@users.noreply.github.com> --- apps/api-extractor/package.json | 2 +- .../bump-minimatch_2026-02-20-02-51.json | 10 +++++ .../bump-minimatch_2026-02-20-02-51.json | 10 +++++ .../subspaces/default/common-versions.json | 2 +- .../config/subspaces/default/pnpm-lock.yaml | 40 ++++++++++++++----- .../config/subspaces/default/repo-state.json | 4 +- libraries/package-extractor/package.json | 2 +- 7 files changed, 56 insertions(+), 14 deletions(-) create mode 100644 common/changes/@microsoft/api-extractor/bump-minimatch_2026-02-20-02-51.json create mode 100644 common/changes/@rushstack/package-extractor/bump-minimatch_2026-02-20-02-51.json diff --git a/apps/api-extractor/package.json b/apps/api-extractor/package.json index a6338cf7e09..f4678bb4ef3 100644 --- a/apps/api-extractor/package.json +++ b/apps/api-extractor/package.json @@ -70,7 +70,7 @@ "@rushstack/ts-command-line": "workspace:*", "diff": "~8.0.2", "lodash": "~4.17.23", - "minimatch": "10.1.2", + "minimatch": "10.2.1", "resolve": "~1.22.1", "semver": "~7.5.4", "source-map": "~0.6.1", diff --git a/common/changes/@microsoft/api-extractor/bump-minimatch_2026-02-20-02-51.json b/common/changes/@microsoft/api-extractor/bump-minimatch_2026-02-20-02-51.json new file mode 100644 index 00000000000..a7d88cd28d6 --- /dev/null +++ b/common/changes/@microsoft/api-extractor/bump-minimatch_2026-02-20-02-51.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "packageName": "@microsoft/api-extractor", + "comment": "Bump minimatch from 10.1.2 to 10.2.1", + "type": "patch" + } + ], + "packageName": "@microsoft/api-extractor" +} diff --git a/common/changes/@rushstack/package-extractor/bump-minimatch_2026-02-20-02-51.json b/common/changes/@rushstack/package-extractor/bump-minimatch_2026-02-20-02-51.json new file mode 100644 index 00000000000..5e488b2595b --- /dev/null +++ b/common/changes/@rushstack/package-extractor/bump-minimatch_2026-02-20-02-51.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "packageName": "@rushstack/package-extractor", + "comment": "Bump minimatch from 10.1.2 to 10.2.1", + "type": "patch" + } + ], + "packageName": "@rushstack/package-extractor" +} diff --git a/common/config/subspaces/default/common-versions.json b/common/config/subspaces/default/common-versions.json index cb1dcad9f6b..a688a847ba3 100644 --- a/common/config/subspaces/default/common-versions.json +++ b/common/config/subspaces/default/common-versions.json @@ -35,7 +35,7 @@ "eslint": "~9.37.0", // Updated minimatch and its types to latest major version to resolve ReDoS vulnerability - "minimatch": "10.1.2" + "minimatch": "10.2.1" }, /** diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml index 23310be4cec..b992ec346ba 100644 --- a/common/config/subspaces/default/pnpm-lock.yaml +++ b/common/config/subspaces/default/pnpm-lock.yaml @@ -89,8 +89,8 @@ importers: specifier: ~4.17.23 version: 4.17.23 minimatch: - specifier: 10.1.2 - version: 10.1.2 + specifier: 10.2.1 + version: 10.2.1 resolve: specifier: ~1.22.1 version: 1.22.11 @@ -3956,8 +3956,8 @@ importers: specifier: ~3.8.0 version: 3.8.0 minimatch: - specifier: 10.1.2 - version: 10.1.2 + specifier: 10.2.1 + version: 10.2.1 npm-packlist: specifier: ~5.1.3 version: 5.1.3 @@ -5608,8 +5608,8 @@ importers: specifier: 1.4.2 version: 1.4.2 minimatch: - specifier: 10.1.2 - version: 10.1.2 + specifier: 10.2.1 + version: 10.2.1 devDependencies: '@rushstack/heft': specifier: workspace:* @@ -11186,6 +11186,10 @@ packages: balanced-match@1.0.2: resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} + balanced-match@4.0.3: + resolution: {integrity: sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==} + engines: {node: 20 || >=22} + base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} @@ -11289,6 +11293,10 @@ packages: brace-expansion@2.0.2: resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==} + brace-expansion@5.0.2: + resolution: {integrity: sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==} + engines: {node: 20 || >=22} + braces@2.3.2: resolution: {integrity: sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==} engines: {node: '>=0.10.0'} @@ -15153,6 +15161,10 @@ packages: resolution: {integrity: sha512-fu656aJ0n2kcXwsnwnv9g24tkU5uSmOlTjd6WyyaKm2Z+h1qmY6bAjrcaIxF/BslFqbZ8UBtbJi7KgQOZD2PTw==} engines: {node: 20 || >=22} + minimatch@10.2.1: + resolution: {integrity: sha512-MClCe8IL5nRRmawL6ib/eT4oLyeKMGCghibcDWK+J0hh0Q8kqSdia6BvbRMVk6mPa6WqUa5uR2oxt6C5jd533A==} + engines: {node: 20 || >=22} + minimatch@3.1.2: resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==} @@ -26180,7 +26192,7 @@ snapshots: '@types/minimatch@6.0.0': dependencies: - minimatch: 10.1.2 + minimatch: 10.2.1 '@types/mocha@10.0.6': {} @@ -27861,6 +27873,8 @@ snapshots: balanced-match@1.0.2: {} + balanced-match@4.0.3: {} + base64-js@1.5.1: {} base@0.11.2: @@ -28013,6 +28027,10 @@ snapshots: dependencies: balanced-match: 1.0.2 + brace-expansion@5.0.2: + dependencies: + balanced-match: 4.0.3 + braces@2.3.2: dependencies: arr-flatten: 1.1.0 @@ -30127,7 +30145,7 @@ snapshots: eslint@8.57.1: dependencies: - '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1) + '@eslint-community/eslint-utils': 4.9.1(eslint@9.37.0) '@eslint-community/regexpp': 4.12.2 '@eslint/eslintrc': 2.1.4 '@eslint/js': 8.57.1 @@ -31136,7 +31154,7 @@ snapshots: dependencies: foreground-child: 3.3.1 jackspeak: 4.1.1 - minimatch: 10.1.2 + minimatch: 10.2.1 minipass: 7.1.2 package-json-from-dist: 1.0.1 path-scurry: 2.0.1 @@ -33267,6 +33285,10 @@ snapshots: dependencies: '@isaacs/brace-expansion': 5.0.1 + minimatch@10.2.1: + dependencies: + brace-expansion: 5.0.2 + minimatch@3.1.2: dependencies: brace-expansion: 1.1.12 diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json index e0aab371844..9b13d6b9d1a 100644 --- a/common/config/subspaces/default/repo-state.json +++ b/common/config/subspaces/default/repo-state.json @@ -1,5 +1,5 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "a97a152eec27dd54ce31e3973f851f572c326c76", - "preferredVersionsHash": "9ba05fe872434900a0b29c308a94015078f37c47" + "pnpmShrinkwrapHash": "425296840bc63395649600913e66041583bdc287", + "preferredVersionsHash": "93bf435032db8da4a18734f1eaa359c12ad147c1" } diff --git a/libraries/package-extractor/package.json b/libraries/package-extractor/package.json index e9ce4e45b84..fdd41e9e8a3 100644 --- a/libraries/package-extractor/package.json +++ b/libraries/package-extractor/package.json @@ -46,7 +46,7 @@ "@rushstack/ts-command-line": "workspace:*", "ignore": "~5.1.6", "jszip": "~3.8.0", - "minimatch": "10.1.2", + "minimatch": "10.2.1", "npm-packlist": "~5.1.3", "semver": "~7.5.4" },