langchain-ai/docs
1
0
Fork 0
mirror of https://github.com/langchain-ai/docs.git synced 2026-07-21 20:05:30 -04:00
Code Issues 490 Packages Projects Releases Wiki Activity

[PR #2855] [MERGED] fix(deps): patch minimatch ReDoS vulnerabilities #2943

New Issue
Closed
opened 2026-06-05 18:20:28 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 18:20:28 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/docs/pull/2855
Author: @jkennedyvz
Created: 2/28/2026
Status: ✅ Merged
Merged: 2/28/2026
Merged by: @jkennedyvz

Base: main ← Head: fix/dependabot-minimatch-vulns

📝 Commits (1)

  • 5d6a876 fix(deps): patch minimatch ReDoS vulnerabilities in reference/

📊 Changes

2 files changed (+14 additions, -34 deletions)

View changed files

📝 reference/package.json (+2 -1)
📝 reference/pnpm-lock.yaml (+12 -33)

📄 Description

Summary

  • Update pnpm overrides in reference/package.json to fix 4 open Dependabot alerts for minimatch ReDoS vulnerabilities
  • minimatch@<3.1.4 → 3.1.4 (was pinned to vulnerable 3.1.3)
  • minimatch@>=10.0.0 <10.2.3 → 10.2.3 (new override for vulnerable 10.1.1)

Test plan

  • Verify reference/pnpm-lock.yaml no longer contains minimatch@3.1.3 or minimatch@10.1.1
  • Verify Dependabot alerts auto-close after merge
  • Confirm pnpm install in reference/ succeeds without errors

🤖 Generated with Claude Code

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/docs/pull/2855 **Author:** [@jkennedyvz](https://github.com/jkennedyvz) **Created:** 2/28/2026 **Status:** ✅ Merged **Merged:** 2/28/2026 **Merged by:** [@jkennedyvz](https://github.com/jkennedyvz) **Base:** `main` ← **Head:** `fix/dependabot-minimatch-vulns` --- ### 📝 Commits (1) - [`5d6a876`](https://github.com/langchain-ai/docs/commit/5d6a876f1f3c4c6fa0d3257c96d702f964e8091c) fix(deps): patch minimatch ReDoS vulnerabilities in reference/ ### 📊 Changes **2 files changed** (+14 additions, -34 deletions) <details> <summary>View changed files</summary> 📝 `reference/package.json` (+2 -1) 📝 `reference/pnpm-lock.yaml` (+12 -33) </details> ### 📄 Description ## Summary - Update pnpm overrides in `reference/package.json` to fix 4 open Dependabot alerts for minimatch ReDoS vulnerabilities - `minimatch@<3.1.4` → `3.1.4` (was pinned to vulnerable `3.1.3`) - `minimatch@>=10.0.0 <10.2.3` → `10.2.3` (new override for vulnerable `10.1.1`) ## Test plan - [ ] Verify `reference/pnpm-lock.yaml` no longer contains `minimatch@3.1.3` or `minimatch@10.1.1` - [ ] Verify Dependabot alerts auto-close after merge - [ ] Confirm `pnpm install` in `reference/` succeeds without errors 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 18:20:28 -04:00
yindo closed this issue 2026-06-05 18:20:28 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
deepagents
docs-infra
external
external
help wanted
integration
internal
internal
javascript
js/ts
langchain
langgraph
langsmith
needs-title
pull-request
Mirrored from GitHub Pull Request
 python
reference
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/docs#2943
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?