mirror of
https://github.com/codewhale-hq/Codewhale.git
synced 2026-11-07 10:36:05 -10:00
CodeWhale Botandisaacs
96d1a62b6c
Backport upstream minimatch preprocessing and glob abort fixes while keeping existing glob, ESTree and build-tool APIs. The rejected minimatch 11 override silently enumerated no files with real glob 9/12 consumers. Preserve versions, licences, original lock bytes and complete upstream audit findings. Postinstall verifies exact versions and complete original/patched hashes for all declared distributions and four bundled runtime copies. The audit checks all concrete reachable advisory leaves and rejects unknown/missing findings, changed sources and pure cycles. Legacy minimatch 3 lacks the reported path. Verified fresh scripts-enabled npm ci (896 packages),7 existing security cases, targeted ESLint, 54 manual preprocessing/abort/bundle/offline-load controls and 7 real glob/ESTree/legacy consumer observations on Node 22.20.0. All 12 matching runtime files accounted for; official archives matched lock SRI. Actual abort controls observed zero reads after rejection. Public NFT tracing preserved 4 files/0 warnings; its private cancellation remains source/hash proof. Raw audit retains 18 moderate package findings; verified mitigation wrapper passes, alert #244 remains OPEN. No registry-fixed, alert-dismissal, full web validation, hosted CI, provider, deployment or release claim. Refs CW-6949/#6560. Evidence: CW/artifacts/engine-0103-qualification-20261101/minimatch/RECEIPT.json Upstream: isaacs/minimatch 77a0f5c and isaacs/node-glob 4682e8c. Co-authored-by: isaacs <[email protected]>