From 1159b7e1afc21038ed8173a8afc5f27fbd1833c8 Mon Sep 17 00:00:00 2001 From: agammann Date: Sat, 31 Oct 2026 18:15:22 -0700 Subject: [PATCH] Override vulnerable glob and minimatch dependencies --- pnpm-lock.yaml | 38 ++++++++++++++++++++------------- pnpm-workspace.yaml | 2 ++ tests/static-dependency.test.ts | 35 ++++++++++++++++++++++++++++++ 3 files changed, 60 insertions(+), 15 deletions(-) create mode 100644 tests/static-dependency.test.ts diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b41a7e0..2ccc98b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,6 +13,8 @@ overrides: undici@>=7 <7.30.1: 7.30.1 fast-uri@>=3 <3.1.9: 3.1.9 fast-uri@>=4 <4.2.3: 4.2.3 + glob@>=9 <14.0.2: 14.0.2 + minimatch@<11.0.1: 11.0.1 importers: @@ -1028,6 +1030,9 @@ packages: cpu: [x64] os: [win32] + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@jridgewell/resolve-uri@3.1.2': resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==} engines: {node: '>=6.0.0'} @@ -1763,8 +1768,8 @@ packages: resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==} engines: {node: '>=10.13.0'} - glob@13.0.6: - resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} + glob@14.0.2: + resolution: {integrity: sha512-vfMgTR2djMHPUchsJMLpZlYQvtjVL+mHpEr5wPpoCbQs2vr/FBNK+3Gnl9Ara1DSs4Aeg4eG9HiADb5/rkY/ZA==} engines: {node: 18 || 20 || >=22} hashery@1.5.1: @@ -1951,8 +1956,8 @@ packages: resolution: {integrity: sha512-GaimS5mSIOMyvd16ga+e1/QkI8cmp3z35QPHFex0DktqNQf2RVZQwMPQXdyoUreUiFP/0Gpe2MoQInTyMAD5xA==} engines: {node: '>=22.0.0'} - minimatch@10.2.6: - resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} + minimatch@11.0.1: + resolution: {integrity: sha512-t+Vn6DX4wPCxS23y03C0uhF7S1jpi1GfqPrnlEipCJaA2ykiNbMkVlDutZtmvLfRcUN6R8AYVlzTsQrT4RZoLQ==} engines: {node: 18 || 20 || >=22} minipass@7.1.3: @@ -2006,8 +2011,8 @@ packages: resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==} engines: {node: '>=8'} - path-scurry@2.0.2: - resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} engines: {node: 18 || 20 || >=22} path-to-regexp@6.3.0: @@ -2868,7 +2873,7 @@ snapshots: dependencies: '@eslint/object-schema': 3.0.5 debug: 4.4.3(supports-color@10.2.2) - minimatch: 10.2.6 + minimatch: 11.0.1 transitivePeerDependencies: - supports-color @@ -2944,7 +2949,7 @@ snapshots: content-disposition: 2.0.1 fastify-plugin: 6.0.0 fastq: 1.20.3 - glob: 13.0.6 + glob: 14.0.2 '@humanfs/core@0.19.2': dependencies: @@ -3068,6 +3073,8 @@ snapshots: '@img/sharp-win32-x64@0.35.5': optional: true + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@jridgewell/resolve-uri@3.1.2': {} '@jridgewell/sourcemap-codec@1.6.0': {} @@ -3287,7 +3294,7 @@ snapshots: '@typescript-eslint/types': 8.70.0 '@typescript-eslint/visitor-keys': 8.70.0 debug: 4.4.3(supports-color@10.2.2) - minimatch: 10.2.6 + minimatch: 11.0.1 semver: 7.8.5 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@6.0.3) @@ -3629,7 +3636,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 - minimatch: 10.2.6 + minimatch: 11.0.1 natural-compare: 1.4.0 optionator: 0.9.4 transitivePeerDependencies: @@ -3752,11 +3759,11 @@ snapshots: dependencies: is-glob: 4.0.3 - glob@13.0.6: + glob@14.0.2: dependencies: - minimatch: 10.2.6 + minimatch: 11.0.1 minipass: 7.1.3 - path-scurry: 2.0.2 + path-scurry: 3.0.0 hashery@1.5.1: dependencies: @@ -3905,8 +3912,9 @@ snapshots: - bufferutil - utf-8-validate - minimatch@10.2.6: + minimatch@11.0.1: dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 minipass@7.1.3: {} @@ -3946,7 +3954,7 @@ snapshots: path-key@3.1.1: {} - path-scurry@2.0.2: + path-scurry@3.0.0: dependencies: lru-cache: 11.5.2 minipass: 7.1.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index cc68645..2ca6da9 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -14,3 +14,5 @@ overrides: undici@>=7 <7.30.1: 7.30.1 fast-uri@>=3 <3.1.9: 3.1.9 fast-uri@>=4 <4.2.3: 4.2.3 + glob@>=9 <14.0.2: 14.0.2 + minimatch@<11.0.1: 11.0.1 diff --git a/tests/static-dependency.test.ts b/tests/static-dependency.test.ts new file mode 100644 index 0000000..9a9e37f --- /dev/null +++ b/tests/static-dependency.test.ts @@ -0,0 +1,35 @@ +import { afterAll, beforeAll, describe, expect, it } from "vitest"; +import Fastify from "fastify"; +import staticFiles from "@fastify/static"; +import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises"; +import { tmpdir } from "node:os"; +import { basename, join, resolve, sep } from "node:path"; + +describe("static file dependency compatibility", () => { + let root: string; + const app = Fastify(); + + beforeAll(async () => { + root = await mkdtemp(join(tmpdir(), "cove-static-")); + await mkdir(join(root, "assets")); + await writeFile(join(root, "assets", "sample.txt"), "static fixture"); + await app.register(staticFiles, { root, wildcard: true }); + }); + + afterAll(async () => { + await app.close(); + if (!root) return; + if ( + !resolve(root).startsWith(resolve(tmpdir()) + sep) || + !basename(root).startsWith("cove-static-") + ) + throw new Error("Refusing to remove an unexpected fixture path"); + await rm(root, { recursive: true, force: true }); + }); + + it("serves a nested asset through Fastify", async () => { + const response = await app.inject({ method: "GET", url: "/assets/sample.txt" }); + expect(response.statusCode).toBe(200); + expect(response.body).toBe("static fixture"); + }); +});