From 6100dd77e5d4c1178aff6fffc2e9acff20606b79 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 04:23:11 +0000 Subject: [PATCH] fix(deps): clear three new OSV advisories (glob, follow-redirects, joi) - glob ^13.0.6 -> ^14.0.3 in @objectstack/metadata and @object-ui/cli (GHSA-3g3m-2fjr-6pw4, fixed in 14.0.2); @object-ui/cli drops the deprecated @types/glob stub, since glob ships its own types. - follow-redirects 1.16.1 -> 1.16.2 (GHSA-mrwp-f3q8-3g9p) and joi 18.3.0 -> 18.3.1 (GHSA-4528-x5fx-h6hg), lockfile only, inside their parents' ranges. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01FEkQ5pWbjNiQvAXymrfTHX --- .changeset/28292-glob-14-advisory.md | 11 +++++ packages/metadata/package.json | 2 +- pnpm-lock.yaml | 67 +++++++++++++++------------- ui/packages/cli/package.json | 3 +- 4 files changed, 48 insertions(+), 35 deletions(-) create mode 100644 .changeset/28292-glob-14-advisory.md diff --git a/.changeset/28292-glob-14-advisory.md b/.changeset/28292-glob-14-advisory.md new file mode 100644 index 00000000000..ee69520cdc3 --- /dev/null +++ b/.changeset/28292-glob-14-advisory.md @@ -0,0 +1,11 @@ +--- +'@objectstack/metadata': patch +'@object-ui/cli': patch +--- + +fix(deps): `glob` goes to `^14.0.3`, past the GHSA-3g3m-2fjr-6pw4 fix in 14.0.2 (#28292) + +Clause-②: no +Metadata-protocol: none + +`@objectstack/metadata` and `@object-ui/cli` declare `glob` as a runtime dependency, so a downstream install now resolves the patched 14 line instead of an affected `13.0.6`. The call sites use only `glob` / `globSync` with `cwd`, `ignore`, `nodir` and `absolute`, which 14 keeps unchanged, and the Node engine floor is the same. `@object-ui/cli` also drops `@types/glob`, a deprecated stub: `glob` ships its own types. No API, behaviour or export changes. diff --git a/packages/metadata/package.json b/packages/metadata/package.json index 7d930e4e25b..c104d5b13e5 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -97,7 +97,7 @@ "@objectstack/spec": "workspace:*", "@objectstack/types": "workspace:*", "chokidar": "^5.0.0", - "glob": "^13.0.6", + "glob": "^14.0.3", "js-yaml": "^5.4.1", "zod": "^4.6.6" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index aece0002023..f493049368f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1345,8 +1345,8 @@ importers: specifier: ^5.0.0 version: 5.0.0 glob: - specifier: ^13.0.6 - version: 13.0.6 + specifier: ^14.0.3 + version: 14.0.3 js-yaml: specifier: ^5.4.1 version: 5.4.2 @@ -4011,9 +4011,6 @@ importers: '@tailwindcss/postcss': specifier: ^4.3.3 version: 4.3.3 - '@types/glob': - specifier: ^9.0.0 - version: 9.0.0 '@vitejs/plugin-react': specifier: ^6.0.5 version: 6.0.5(vite@8.3.5(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15(patch_hash=4d1d35da1809be2a945519cb26890e48107810b9b66c6913a6a89abb5ad6a1e6))(yaml@2.9.1)) @@ -4033,8 +4030,8 @@ importers: specifier: ^8.6.2 version: 8.6.2(express@4.22.2) glob: - specifier: ^13.0.6 - version: 13.0.6 + specifier: ^14.0.3 + version: 14.0.3 js-yaml: specifier: ^5.4.1 version: 5.4.2 @@ -7048,6 +7045,9 @@ packages: '@ioredis/commands@2.0.0': resolution: {integrity: sha512-vrx0AE/T0h7cRZwfo1M39Cr+ZhZrkf0V8mQN75wucKCxCLD9l/VX6no3gFvrLqD1IlG/1LtzWovqEw3t0Vr9zg==} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@jitl/quickjs-ffi-types@0.32.0': resolution: {integrity: sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg==} @@ -8807,10 +8807,6 @@ packages: '@types/geojson@7946.0.16': resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==} - '@types/glob@9.0.0': - resolution: {integrity: sha512-00UxlRaIUvYm4R4W9WYkN8/J+kV8fmOQ7okeH6YFtGWFMt3odD45tpG5yA5wnL7HE6lLgjaTW5n14ju2hl2NNA==} - deprecated: This is a stub types definition. glob provides its own type definitions, so you do not need this installed. - '@types/hast@3.0.5': resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==} @@ -10512,8 +10508,8 @@ packages: flatted@3.4.4: resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==} - follow-redirects@1.16.1: - resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==} + follow-redirects@1.16.2: + resolution: {integrity: sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -10745,8 +10741,8 @@ packages: glob-to-regexp@0.4.1: resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==} - glob@13.0.6: - resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} + glob@14.0.3: + resolution: {integrity: sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==} engines: {node: 18 || 20 || >=22} glob@7.2.3: @@ -11111,8 +11107,8 @@ packages: jju@1.4.0: resolution: {integrity: sha512-8wb9Yw966OSxApiCt0K3yNJL8pnNeIv+OEq2YMidz4FKP6nonSRoOXc80iXY4JaN2FC11B9qsNmDsm+ZOfMROA==} - joi@18.3.0: - resolution: {integrity: sha512-/RwAK4BAfzcdbdFg073tzq4/xhY6Q7lMd5AmjqTL6pu0QFJdEmtswgm8BvgwXvOKuPNYQ8XrdQrrW/gF65LiNw==} + joi@18.3.1: + resolution: {integrity: sha512-mV9M4Llh4va3NT90p7KBtQhoZqjs8xLX7EWYE4y/GG3yLF6REbIBEHSUb0UX1JXRht2w5tiLSsvmpYc5akiqIw==} engines: {node: '>= 20'} jose@6.2.12: @@ -11837,6 +11833,10 @@ packages: resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} engines: {node: 18 || 20 || >=22} + minimatch@11.0.3: + resolution: {integrity: sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==} + engines: {node: 18 || 20 || >=22} + minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -12166,8 +12166,8 @@ packages: path-parse@1.0.7: resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==} - path-scurry@2.0.2: - resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} engines: {node: 18 || 20 || >=22} path-to-regexp@0.1.13: @@ -15018,6 +15018,8 @@ snapshots: '@ioredis/commands@2.0.0': {} + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@jitl/quickjs-ffi-types@0.32.0': {} '@jitl/quickjs-wasmfile-debug-asyncify@0.32.0': @@ -16803,10 +16805,6 @@ snapshots: '@types/geojson@7946.0.16': {} - '@types/glob@9.0.0': - dependencies: - glob: 13.0.6 - '@types/hast@3.0.5': dependencies: '@types/unist': 3.0.3 @@ -17384,7 +17382,7 @@ snapshots: axios@1.20.0: dependencies: - follow-redirects: 1.16.1(debug@4.4.3) + follow-redirects: 1.16.2(debug@4.4.3) form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 @@ -18606,7 +18604,7 @@ snapshots: flatted@3.4.4: {} - follow-redirects@1.16.1(debug@4.4.3): + follow-redirects@1.16.2(debug@4.4.3): optionalDependencies: debug: 4.4.3(supports-color@8.1.1) @@ -18814,11 +18812,11 @@ snapshots: glob-to-regexp@0.4.1: {} - glob@13.0.6: + glob@14.0.3: dependencies: - minimatch: 10.2.6 + minimatch: 11.0.3 minipass: 7.1.3 - path-scurry: 2.0.2 + path-scurry: 3.0.0 glob@7.2.3: dependencies: @@ -19241,7 +19239,7 @@ snapshots: jju@1.4.0: {} - joi@18.3.0: + joi@18.3.1: dependencies: '@hapi/address': 5.1.1 '@hapi/formula': 3.0.2 @@ -20208,6 +20206,11 @@ snapshots: dependencies: brace-expansion: 5.0.12 + minimatch@11.0.3: + dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 + brace-expansion: 5.0.12 + minimist@1.2.8: {} minipass@7.1.3: {} @@ -20239,7 +20242,7 @@ snapshots: camelcase: 6.3.0 debug: 4.4.3(supports-color@8.1.1) find-cache-dir: 3.3.2 - follow-redirects: 1.16.1(debug@4.4.3) + follow-redirects: 1.16.2(debug@4.4.3) https-proxy-agent: 7.0.6 mongodb: 7.5.0(socks@2.8.9) new-find-package-json: 2.0.0 @@ -20541,7 +20544,7 @@ snapshots: path-parse@1.0.7: {} - path-scurry@2.0.2: + path-scurry@3.0.0: dependencies: lru-cache: 11.5.3 minipass: 7.1.3 @@ -22244,7 +22247,7 @@ snapshots: wait-on@9.5.1: dependencies: axios: 1.20.0 - joi: 18.3.0 + joi: 18.3.1 lodash: 4.18.1 rxjs: 7.8.2 transitivePeerDependencies: diff --git a/ui/packages/cli/package.json b/ui/packages/cli/package.json index dce503cc0d1..db0d8c0b2c7 100644 --- a/ui/packages/cli/package.json +++ b/ui/packages/cli/package.json @@ -59,14 +59,13 @@ "@object-ui/types": "workspace:*", "@objectstack/spec": "workspace:^", "@tailwindcss/postcss": "^4.3.3", - "@types/glob": "^9.0.0", "@vitejs/plugin-react": "^6.0.5", "autoprefixer": "^10.5.4", "chalk": "^6.0.0", "commander": "^15.0.0", "express": "^4.22.2", "express-rate-limit": "^8.6.2", - "glob": "^13.0.6", + "glob": "^14.0.3", "js-yaml": "^5.4.1", "jsonc-parser": "^3.3.1", "vite": "^8.2.1"