[poastro]

Updates

• Description
• References

Comments
Hello,

Could you clarify the affected-version range in:
GHSA-g3hv-75wg-m249

The advisory describes pattern amplification in minimatch 10.2.6 involving firstPhasePreProcess(), secondPhasePreProcess(), and optimizationLevel >= 2. Its current npm affected range is <11.0.1, which also includes legacy 3.x and 5.x releases.

Inspection of the published npm tarballs gives the following results for the CommonJS entry points:

Version | firstPhasePreProcess | secondPhasePreProcess | optimizationLevel
3.1.5 | absent | absent | absent
5.1.9 | absent | absent | absent
10.2.6 | present | present | present

The observations can be reproduced by retrieving each public npm metadata document below, downloading its dist.tarball, verifying the published SHA-512 integrity, and inspecting the CommonJS entry point. No application code is needed.

The range also propagates audit findings into public dependency chains such as:

exceljs@4.4.0 -> archiver@5.3.2 -> archiver-utils@2.1.0 -> glob@7.2.3 -> minimatch@3.1.5
exceljs@4.4.0 -> archiver@5.3.2 -> readdir-glob@1.1.3 -> minimatch@5.1.9
exceljs@4.4.0 -> archiver@5.3.2 -> zip-stream@4.1.1 -> archiver-utils@3.0.4 -> glob@7.2.3 -> minimatch@3.1.5
exceljs@4.4.0 -> unzipper@0.10.14 -> fstream@1.0.12 -> rimraf@2.7.1 -> glob@7.2.3 -> minimatch@3.1.5

These are reproducible from public package metadata; no private application's lockfile or configuration is attached. The metadata declares version ranges, so exact resolved versions may change in a newly created installation.

Could you please confirm:

1. Whether legacy minimatch 3.1.5 and 5.1.9 are affected by this same vulnerability through a different mechanism.
2. If they are affected, the relevant legacy code path or a bounded, version-specific reproducer and the appropriate fixed legacy releases, if available.
3. If they are not affected by this advisory, whether the affected range can be narrowed to the releases that contain the vulnerable mechanism.

Absence of these identifiers alone does not prove absence of every vulnerability. This request concerns the consistency between this advisory's described mechanism and its affected-version metadata. It does not request an audit bypass, severity downgrade, or suppression of a confirmed vulnerability.

Public references and entry points:

• https://registry.npmjs.org/minimatch/3.1.5 — package/minimatch.js
• https://registry.npmjs.org/minimatch/5.1.9 — package/minimatch.js
• https://registry.npmjs.org/minimatch/10.2.6 — package/dist/commonjs/index.js
• https://registry.npmjs.org/exceljs/4.4.0
• https://registry.npmjs.org/archiver/5.3.2
• https://registry.npmjs.org/readdir-glob/1.1.3
• https://registry.npmjs.org/glob/7.2.3

No attachments or private files are supplied. A dependency-free source-inspection script and public integrity results can be provided if useful through an appropriate channel.

Thank you for reviewing the scope.

[github]

Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory