feat(deps): Bump glob in @sentry/react-router#19162
feat(deps): Bump glob in @sentry/react-router#19162chargome merged 3 commits intogetsentry:developfrom
glob in @sentry/react-router#19162Conversation
Lms24
left a comment
Lms24
left a comment
There was a problem hiding this comment.
Thanks for submitting this PR! Sounds reasonable to me to bump this. @chargome any concerns regarding the major bumps? I don't think any of the breaking changes apply to RR.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
packages/react-router/package.json
Outdated
| "@sentry/react": "10.38.0", | ||
| "@sentry/vite-plugin": "^4.8.0", | ||
| "glob": "11.1.0" | ||
| "glob": "13.0.1" |
There was a problem hiding this comment.
Glob v13 may break CJS consumers
High Severity
Upgrading glob to 13.0.1 may introduce a breaking runtime change for CommonJS consumers of @sentry/react-router if glob’s v13 exports/module format no longer supports require() or behaves differently in CJS (notably for array patterns passed to glob() in sentryOnBuildEnd).
Additional Locations (1)
chargome
left a comment
chargome
left a comment
There was a problem hiding this comment.
This one is just used for onBuildEnd so we should be fine, thanks for contributing!
chargome
changed the title
glob in @sentry/react-router
packages/react-router/package.json
Outdated
| "@sentry/react": "10.38.0", | ||
| "@sentry/vite-plugin": "^4.8.0", | ||
| "glob": "11.1.0" | ||
| "glob": "13.0.1" |
There was a problem hiding this comment.
| "glob": "13.0.1" | |
| "glob": "^13.0.1" |
There was a problem hiding this comment.
@rfoel please apply this and re-run yarn before merging in
3 participants
Bumps
globfrom11.1.0to13.0.1in@sentry/react-routerto resolve a security vulnerability in the transitive dependency@isaacs/brace-expansion.Dependency chain:
@sentry/react-router→glob→minimatch→@isaacs/brace-expansionDetails
The previous version of
glob(11.1.0) pulled in a vulnerable version of@isaacs/brace-expansion. The vulnerability has been patched upstream:@isaacs/brace-expansionwas patchedminimatchreleased a new version with the fixglob13.0.1 includes the updated dependenciesThis is a dependency-only change with no code modifications.
CVE