versions >= 9.0.6 is a breaking change

[zhonig]

Hello,

Versions >= 9.0.6 requires Node "18 || 20 || >=22".
For projects relying on semver ranges this will break their installation if they are on Node <18 (ie: Node 16.x).

v9.0.5 uses brace-expansion@^2.0.1
versions >= 9.0.6 uses brace-expansion@^5.0.2

brace-expansion does not support node versions < 18 starting at version 3 (https://github.com/juliangruber/brace-expansion/blob/v3.0.0/package.json#L47-L49)

Can we please revert the breaking changes to maintain backwards compatibility?

Thanks!

[G-Rath]

Sort of a duplicate of #282 - I had opened #283 to address this, but @isaacs feels it reintroduces a security issue, though I'm not sure how myself

[isaacs]

Oh, I see, you were downgrading it only on v9, not on latest.

Hm. That's tricky. I guess it could be reverted in v9, since the brace-expansion issue wasn't fixed to begin with.

The advisory was GHSA-7h2j-956f-4vf2, which was only reported to @isaacs/brace-expansion (my fork) prior to being merged in. But only the v5 branch of the mainline brace-expansion has the fix, and idk if @juliangruber is interested in backporting it to the v2 line.

[juliangruber]

I'm happy to backport if we agree this is a vulnerability to fix. So far I hadn't implemented a fix for it although it was reported a few times, since I consider this the intended behavior, and the fix more a nice-to-have / DX feature. It's like saying new Array(n) has a vulnerability, you need to control what to pass as n. I was however happy to merge in the fix, as it does just make the library nicer and more friendly to use. If we agree this is relevant, I'm happy to backport to the v2 line.

[a-teece]

@juliangruber I think there might be more to this than just the node version being used.

We witnessed eslint failing as part of an Azure DevOps build pipeline, making use of Node 22.21.1.

It no longer matched any file in our repo using the pattern **/*.{js,ts}

Given that the timing of the break and fix perfectly matches the release of minmatch 9.0.7 and 9.0.8 I think the impact of this change was pretty big. Obviously the real fault is with eslint not pinning particular versions for repeatable/predictable behaviour. But your minmatch package is clearly of global importance in the worlds build piplines.

See microsoft/security-devops-action#189

[isaacs]

But your minmatch package is clearly of global importance in the worlds build piplines.

If Microsoft cannot support their customers without reliance on the unpaid labor of third parties, then they do not deserve customers. The world is not entitled to unlimited amounts of my time and attention, or that of any OSS maintainer, I'm sorry.

I'm not trying to be a jerk, and I'm sure you're a nice person who means well. I'm also sure that @juliangruber will be willing to fix the bug in brace-expansion if it is reported and a PR is made that improves the code and adds tests, just as I will with minimatch. But the stance of "Oh, no! The world is on fire because you're so important!" is really not the compelling incentive you might think, since the world gives me exactly nothing in exchange for such attention to urgency. If anything, it's a source of resentment and disdain, that so many people in the world apparently feel so entitled to the free labor of OSS maintainers, but cannot be bothered to pay us enough to survive by doing this work. For real, makes a guy wanna flip the table _why-style.

[a-teece]

@isaacs I certainly didnt mean to cause offence. And I completely understand your points on the commercial use of the code.

However although my usage was from a Microsoft product what i really meant to call out in recognising your global importance was that Eslint, an OSS product, used by OSS products broke.

[isaacs]

@a-teece Completely understand, no worries.

[G-Rath]

@a-teece

I think there might be more to this than just the node version being used.

I would wager at this point the other issue you're running into is juliangruber/brace-expansion#88 which was introduced in v3, so besides a fix for v5 hopefully being landed soon, if minimatch@9 downgrades back to v2 it won't be an issue anymore

[G-Rath]

so looking over the advisory, I agree with you @juliangruber that its a stretch to say its a vuln in brace-expansion, but at the same time the "fix" is definitely really useful to help guard against applications having a vuln and it feels like it should be pretty compatible w/ the v2 branch so honestly it might be best to backport it just so it's over with 🤷

Let me know if you'd like a hand with that

[juliangruber]

The fix (pr 88) landed in + brace-expansion@5.0.4. Which versions does this need to be backported to? Or is it about backporting the DX improvement? Or is it about both?

[isaacs]

9.x rolled back to brace-expansion 2.