Repository navigation
fix: upgrade glob from 13.0.6 to 13.0.7 - #1108
cursor[bot] wants to merge 1 commit into
Conversation
Resolve the glob ^13 ranges to 13.0.7, which backports the abort-signal fix for CVE-2026-118773 without leaving the ranges Expo and rimraf request. Co-authored-by: chris <chris@knock.app>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1108 +/- ##
=======================================
Coverage 78.48% 78.48%
=======================================
Files 140 140
Lines 4508 4508
Branches 1314 1314
=======================================
Hits 3538 3538
Misses 873 873
Partials 97 97 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Could not approve: GitHub does not allow this automation to approve its own pull request. Human review is needed, and no reviewers were assigned in this run. CI is green on a transitive glob 13.0.6 → 13.0.7 lockfile bump.
Sent by Cursor Approval Agent: SDK approver
There was a problem hiding this comment.
Would approve this lockfile-only glob 13.0.6 → 13.0.7 patch with green CI, but GitHub rejected the approval because this identity authored the PR. Human review is needed for that platform reason; no reviewers were assigned.
Sent by Cursor Approval Agent: Depdency updates (control, switchboard, CLI, javascript, telegraph)
Description
The 2026-11-06 Vanta scan of the javascript repository reports three open findings. This PR fixes the one that now has a compatible release.
glob 13.0.6 → 13.0.7 (low). CVE-2026-118773 / GHSA-3g3m-2fjr-6pw4. First detected 2026-11-01. Remediate by 2026-12-16.
Linear: https://linear.app/knock/issue/KNO-16489/js-upgrade-glob-from-1306-to-1307
glob@13.0.7(published 2026-11-06) backports the abort-signal fix onto the 13.x line. Abort branches insrc/walker.tsreturn after the callback, so a cancelled walk does not keep reading directories.@expo/cli,@expo/config-plugins,@expo/fingerprint,@expo/metro-config, andrimraf@6requestglob@^13, which includes 13.0.7. The lockfile resolves those ranges to 13.0.7 and leaves glob 7 and glob 10 unchanged.GitHub advisory GHSA-3g3m-2fjr-6pw4 was last modified 2026-10-30 and still records the fix as 14.0.2. Glob 14 depends on minimatch 11 and changes matcher behavior, so this stays on the 13.0.7 backport.
Two other open findings have no compatible patched release, so this PR does not change them:
makeRe().@trivago/prettier-plugin-sort-imports@6.0.2,@typescript-eslint/typescript-estree@7.18.0,@vue/language-core@2.2.0, andglob@10.4.5still requestminimatch@^9. https://linear.app/knock/issue/KNO-16440/js-minimatch-909-needs-minimatch-11yargs@^17.6.2. https://linear.app/knock/issue/KNO-16335/js-yargs-1772-fix-requires-yargs-18Next.js 15.5.28 is no longer in this scan.
Todos
None.
Checklist
glob@13.0.7walker returns on abort, and a local walk aborted on the firstreaddirdid not issue another read.Screenshots or videos
Not applicable.