Skip to content

fix: update glob to v10.5.0 to resolve CVE-2025-64756 #910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 24, 2025
Merged

fix: update glob to v10.5.0 to resolve CVE-2025-64756 #910

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1afe79e
fix: update glob to v10.5.0 to resolve CVE-2025-64756
ramanathanMuthuraman Nov 22, 2025
630fc82
chore: update yarn.lock for glob upgrade
ramanathanMuthuraman Nov 22, 2025
dea70b0
chore: update yarn.lock with Yarn 4.11.0
ramanathanMuthuraman Nov 22, 2025
0fda4fd
chore: update yarn.lock with correct compression settings
ramanathanMuthuraman Nov 22, 2025
1f1c339
fix: remove glob from resolutions
ramanathanMuthuraman Nov 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,8 @@
"typescript": "^5.8.3"
},
"resolutions": {
"@rspress/plugin-llms@2.0.0-beta.34": "patch:@rspress/plugin-llms@npm%3A2.0.0-beta.34#./.yarn/patches/@rspress-plugin-llms-npm-2.0.0-beta.34-d374542281.patch"
"@rspress/plugin-llms@2.0.0-beta.34": "patch:@rspress/plugin-llms@npm%3A2.0.0-beta.34#./.yarn/patches/@rspress-plugin-llms-npm-2.0.0-beta.34-d374542281.patch",
"glob": "^10.5.0"
},
"packageManager": "yarn@4.11.0",
"commitlint": {
Expand Down
3 changes: 1 addition & 2 deletions packages/react-native-builder-bob/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
"del": "^6.1.1",
"escape-string-regexp": "^4.0.0",
"fs-extra": "^10.1.0",
"glob": "^8.0.3",
"glob": "^10.5.0",
"is-git-dirty": "^2.0.1",
"json5": "^2.2.1",
"kleur": "^4.1.4",
Expand All @@ -71,7 +71,6 @@
"@types/dedent": "^0.7.0",
"@types/del": "^4.0.0",
"@types/fs-extra": "^9.0.13",
"@types/glob": "^7.2.0",
"@types/json5": "^2.2.0",
"@types/mock-fs": "^4.13.4",
"@types/prompts": "^2.0.14",
Expand Down
4 changes: 2 additions & 2 deletions packages/react-native-builder-bob/src/utils/compile.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import path from 'path';
import fs from 'fs-extra';
import kleur from 'kleur';
import * as babel from '@babel/core';
import glob from 'glob';
import { globSync } from 'glob';
import type { Input, Variants } from '../types';
import { isCodegenSpec } from './isCodegenSpec';

Expand Down Expand Up @@ -39,7 +39,7 @@ export default async function compile({
jsxRuntime = 'automatic',
variants,
}: Options) {
const files = glob.sync('**/*', {
const files = globSync('**/*', {
cwd: source,
absolute: true,
nodir: true,
Expand Down
115 changes: 27 additions & 88 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4292,16 +4292,6 @@ __metadata:
languageName: node
linkType: hard

"@types/glob@npm:^7.2.0":
version: 7.2.0
resolution: "@types/glob@npm:7.2.0"
dependencies:
"@types/minimatch": "npm:*"
"@types/node": "npm:*"
checksum: 10c0/a8eb5d5cb5c48fc58c7ca3ff1e1ddf771ee07ca5043da6e4871e6757b4472e2e73b4cfef2644c38983174a4bc728c73f8da02845c28a1212f98cabd293ecae98
languageName: node
linkType: hard

"@types/hast@npm:^3.0.0, @types/hast@npm:^3.0.4":
version: 3.0.4
resolution: "@types/hast@npm:3.0.4"
Expand Down Expand Up @@ -4368,13 +4358,6 @@ __metadata:
languageName: node
linkType: hard

"@types/minimatch@npm:*":
version: 5.1.2
resolution: "@types/minimatch@npm:5.1.2"
checksum: 10c0/83cf1c11748891b714e129de0585af4c55dd4c2cafb1f1d5233d79246e5e1e19d1b5ad9e8db449667b3ffa2b6c80125c429dbee1054e9efb45758dbc4e118562
languageName: node
linkType: hard

"@types/minimist@npm:^1.2.0":
version: 1.2.2
resolution: "@types/minimist@npm:1.2.2"
Expand Down Expand Up @@ -7879,13 +7862,6 @@ __metadata:
languageName: node
linkType: hard

"fs.realpath@npm:^1.0.0":
version: 1.0.0
resolution: "fs.realpath@npm:1.0.0"
checksum: 10c0/444cf1291d997165dfd4c0d58b69f0e4782bfd9149fd72faa4fe299e68e0e93d6db941660b37dd29153bf7186672ececa3b50b7e7249477b03fdf850f287c948
languageName: node
linkType: hard

"fsevents@npm:~2.3.2, fsevents@npm:~2.3.3":
version: 2.3.3
resolution: "fsevents@npm:2.3.3"
Expand Down Expand Up @@ -8131,45 +8107,19 @@ __metadata:
languageName: node
linkType: hard

"glob@npm:^10.2.2":
version: 10.3.4
resolution: "glob@npm:10.3.4"
"glob@npm:^10.5.0":
version: 10.5.0
resolution: "glob@npm:10.5.0"
dependencies:
foreground-child: "npm:^3.1.0"
jackspeak: "npm:^2.0.3"
minimatch: "npm:^9.0.1"
minipass: "npm:^5.0.0 || ^6.0.2 || ^7.0.0"
path-scurry: "npm:^1.10.1"
jackspeak: "npm:^3.1.2"
minimatch: "npm:^9.0.4"
minipass: "npm:^7.1.2"
package-json-from-dist: "npm:^1.0.0"
path-scurry: "npm:^1.11.1"
bin:
glob: dist/cjs/src/bin.js
checksum: 10c0/fe075f8109749cb0c264fd6eee8bf0cc8bb23a02305619b7a88bf1f79766218cc3ef66a3e8f3cd2e826006f047a3a8833c1694f167e978a6e37c34a8c053e48e
languageName: node
linkType: hard

"glob@npm:^7.1.3, glob@npm:^7.1.4, glob@npm:^7.2.0":
version: 7.2.3
resolution: "glob@npm:7.2.3"
dependencies:
fs.realpath: "npm:^1.0.0"
inflight: "npm:^1.0.4"
inherits: "npm:2"
minimatch: "npm:^3.1.1"
once: "npm:^1.3.0"
path-is-absolute: "npm:^1.0.0"
checksum: 10c0/65676153e2b0c9095100fe7f25a778bf45608eeb32c6048cf307f579649bcc30353277b3b898a3792602c65764e5baa4f643714dfbdfd64ea271d210c7a425fe
languageName: node
linkType: hard

"glob@npm:^8.0.3":
version: 8.1.0
resolution: "glob@npm:8.1.0"
dependencies:
fs.realpath: "npm:^1.0.0"
inflight: "npm:^1.0.4"
inherits: "npm:2"
minimatch: "npm:^5.0.1"
once: "npm:^1.3.0"
checksum: 10c0/cb0b5cab17a59c57299376abe5646c7070f8acb89df5595b492dba3bfb43d301a46c01e5695f01154e6553168207cb60d4eaf07d3be4bc3eb9b0457c5c561d0f
glob: dist/esm/bin.mjs
checksum: 10c0/100705eddbde6323e7b35e1d1ac28bcb58322095bd8e63a7d0bef1a2cdafe0d0f7922a981b2b48369a4f8c1b077be5c171804534c3509dfe950dde15fbe6d828
languageName: node
linkType: hard

Expand Down Expand Up @@ -8807,17 +8757,7 @@ __metadata:
languageName: node
linkType: hard

"inflight@npm:^1.0.4":
version: 1.0.6
resolution: "inflight@npm:1.0.6"
dependencies:
once: "npm:^1.3.0"
wrappy: "npm:1"
checksum: 10c0/7faca22584600a9dc5b9fca2cd5feb7135ac8c935449837b315676b4c90aa4f391ec4f42240178244b5a34e8bede1948627fda392ca3191522fc46b34e985ab2
languageName: node
linkType: hard

"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3":
"inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3":
version: 2.0.4
resolution: "inherits@npm:2.0.4"
checksum: 10c0/4e531f648b29039fb7426fb94075e6545faa1eb9fe83c29f0b6d9e7263aceb4289d2d4557db0d428188eeb449cc7c5e77b0a0b2c4e248ff2a65933a0dee49ef2
Expand Down Expand Up @@ -9234,16 +9174,16 @@ __metadata:
languageName: node
linkType: hard

"jackspeak@npm:^2.0.3":
version: 2.3.3
resolution: "jackspeak@npm:2.3.3"
"jackspeak@npm:^3.1.2":
version: 3.4.3
resolution: "jackspeak@npm:3.4.3"
dependencies:
"@isaacs/cliui": "npm:^8.0.2"
"@pkgjs/parseargs": "npm:^0.11.0"
dependenciesMeta:
"@pkgjs/parseargs":
optional: true
checksum: 10c0/787b0617dcc534ef793ba685b92347b1b3d634d888b2833a57b140e97eb1f628ec3e460ba1a68fd99bd148004442625db7519be186b38ff51f4951e7c99b52d7
checksum: 10c0/6acc10d139eaefdbe04d2f679e6191b3abf073f111edf10b1de5302c97ec93fffeb2fdd8681ed17f16268aa9dd4f8c588ed9d1d3bffbbfa6e8bf897cbb3149b9
languageName: node
linkType: hard

Expand Down Expand Up @@ -10891,7 +10831,7 @@ __metadata:
languageName: node
linkType: hard

"minimatch@npm:^3.1.1, minimatch@npm:^3.1.2":
"minimatch@npm:^3.1.2":
version: 3.1.2
resolution: "minimatch@npm:3.1.2"
dependencies:
Expand All @@ -10909,7 +10849,7 @@ __metadata:
languageName: node
linkType: hard

"minimatch@npm:^9.0.0, minimatch@npm:^9.0.1, minimatch@npm:^9.0.3, minimatch@npm:^9.0.4, minimatch@npm:^9.0.5":
"minimatch@npm:^9.0.0, minimatch@npm:^9.0.3, minimatch@npm:^9.0.4, minimatch@npm:^9.0.5":
version: 9.0.5
resolution: "minimatch@npm:9.0.5"
dependencies:
Expand Down Expand Up @@ -11467,7 +11407,7 @@ __metadata:
languageName: node
linkType: hard

"once@npm:^1.3.0, once@npm:^1.3.1, once@npm:^1.4.0":
"once@npm:^1.3.1, once@npm:^1.4.0":
version: 1.4.0
resolution: "once@npm:1.4.0"
dependencies:
Expand Down Expand Up @@ -11642,6 +11582,13 @@ __metadata:
languageName: node
linkType: hard

"package-json-from-dist@npm:^1.0.0":
version: 1.0.1
resolution: "package-json-from-dist@npm:1.0.1"
checksum: 10c0/62ba2785eb655fec084a257af34dbe24292ab74516d6aecef97ef72d4897310bc6898f6c85b5cd22770eaa1ce60d55a0230e150fb6a966e3ecd6c511e23d164b
languageName: node
linkType: hard

"pacote@npm:^21.0.0":
version: 21.0.0
resolution: "pacote@npm:21.0.0"
Expand Down Expand Up @@ -11797,13 +11744,6 @@ __metadata:
languageName: node
linkType: hard

"path-is-absolute@npm:^1.0.0":
version: 1.0.1
resolution: "path-is-absolute@npm:1.0.1"
checksum: 10c0/127da03c82172a2a50099cddbf02510c1791fc2cc5f7713ddb613a56838db1e8168b121a920079d052e0936c23005562059756d653b7c544c53185efe53be078
languageName: node
linkType: hard

"path-key@npm:^3.0.0, path-key@npm:^3.1.0":
version: 3.1.1
resolution: "path-key@npm:3.1.1"
Expand All @@ -11825,7 +11765,7 @@ __metadata:
languageName: node
linkType: hard

"path-scurry@npm:^1.10.1":
"path-scurry@npm:^1.11.1":
version: 1.11.1
resolution: "path-scurry@npm:1.11.1"
dependencies:
Expand Down Expand Up @@ -12214,7 +12154,6 @@ __metadata:
"@types/dedent": "npm:^0.7.0"
"@types/del": "npm:^4.0.0"
"@types/fs-extra": "npm:^9.0.13"
"@types/glob": "npm:^7.2.0"
"@types/json5": "npm:^2.2.0"
"@types/mock-fs": "npm:^4.13.4"
"@types/prompts": "npm:^2.0.14"
Expand All @@ -12229,7 +12168,7 @@ __metadata:
del: "npm:^6.1.1"
escape-string-regexp: "npm:^4.0.0"
fs-extra: "npm:^10.1.0"
glob: "npm:^8.0.3"
glob: "npm:^10.5.0"
is-git-dirty: "npm:^2.0.1"
json5: "npm:^2.2.1"
kleur: "npm:^4.1.4"
Expand Down