Conversation
…pp upgrade Upgrade eslint-config-sentry-app from 1.x to 2.x, which brings @typescript-eslint from 6.x to 8.x. This eliminates the exact-pinned [email protected] dependency that was flagging three ReDoS advisories (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74). Also upgrade via lockfile resolution: - cross-spawn 7.0.3 → 7.0.6 (GHSA-3xgq-45jj-v275) - @babel/helpers + @babel/runtime 7.20.1 → 7.28.6 (GHSA-968p-4wvh-cqc8) - ajv 6.12.6 → 6.14.0 (GHSA-2g4f-4pwh-qvx6) Lint and tests pass without changes to .eslintrc.js. Co-Authored-By: Claude <[email protected]>
Add optional platform-specific @unrs/resolver-binding-* entries and their WASM fallback deps (@emnapi/*, @napi-rs/wasm-runtime) that eslint-import-resolver-typescript (via eslint-config-sentry-app 2.x) pulls in. Also normalizes key ordering from a second yarn install run. Co-Authored-By: Claude <[email protected]>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| "@types/yargs": "^17.0.32", | ||
| "eslint": "^8.56.0", | ||
| "eslint-config-sentry-app": "^1.129.0", | ||
| "eslint-config-sentry-app": "^2.10.0", |
There was a problem hiding this comment.
ESLint 8.56.0 below @typescript-eslint 8.x minimum requirement
Medium Severity
The eslint-config-sentry-app 2.x upgrade brings in @typescript-eslint 8.x (resolved to 8.56.1 in the lockfile), which requires eslint ^8.57.0 || ^9.0.0 as a peer dependency. However, eslint remains specified as ^8.56.0 and is lockfile-pinned to 8.56.0, which does not satisfy ^8.57.0. The PR description incorrectly states the peer requirement is >=8. The eslint version specifier needs to be bumped to at least ^8.57.0.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| "eslint-config-sentry-app": "^2.10.0", | ||
| "jest": "^29.7.0", | ||
| "jest-fetch-mock": "^3.0.3", | ||
| "jest-image-snapshot": "5.1.0", |
There was a problem hiding this comment.
Bug: The resolutions field in package.json forces minimatch to 9.0.9, which is incompatible with dependencies requiring minimatch@^3.x or minimatch@^10.x, violating semantic versioning.
Severity: MEDIUM
Suggested Fix
Remove the minimatch entry from the resolutions block in package.json. This will allow yarn to resolve the correct versions of minimatch for each dependency according to their specified semantic versioning ranges, preventing potential API incompatibilities and runtime errors.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L43
Potential issue: The `resolutions` field in `package.json` pins `minimatch` to version
`9.0.9` for all dependencies. However, the dependency tree requires other major
versions, such as `^3.x` and `^10.x`. Forcing version `9.0.9` violates the semantic
versioning contract for these packages. This can lead to runtime errors or unexpected
behavior when a dependency attempts to use an API or feature from `minimatch` that has
changed between major versions. For example, a package expecting `minimatch@^3.1.2`
might fail if an expected API from the 3.x series is different or absent in version 9.x.
Did we get this right? 👍 / 👎 to inform future reviews.
2 participants
Fix all 10 vulnerabilities (7 high, 3 moderate) reported by
npm audit.Root causes and fixes:
GHSA-3ppc-4f35-3m26 / GHSA-7r86-cg39-jmmj / GHSA-23c5-xmqv-rm74 (minimatch ReDoS, high):
@typescript-eslint/[email protected]declared an exact pin[email protected], which sits in the vulnerable range 9.0.0–9.0.6. Upgradingeslint-config-sentry-appfrom 1.x to 2.x brings@typescript-eslintfrom 6.x to 8.x, which uses a proper range^9.0.4instead. Our existing"minimatch": "9.0.9"resolution then satisfies this safely.GHSA-3xgq-45jj-v275 (cross-spawn ReDoS, high): lockfile-pinned to 7.0.3;
^7.0.2allows 7.0.6 (fixed in 7.0.5) — resolved via lockfile upgrade.GHSA-968p-4wvh-cqc8 (@babel/helpers + @babel/runtime ReDoS, moderate): lockfile-pinned to 7.20.1;
^7.19.4/^7.16.3allow 7.28.6 — resolved via lockfile upgrade.GHSA-2g4f-4pwh-qvx6 (ajv ReDoS, moderate): lockfile-pinned to 6.12.6;
^6.12.4allows 6.14.0 — resolved via lockfile upgrade.The
eslint-config-sentry-app2.x upgrade is backwards-compatible:extends: ['sentry-app/strict']still works (strict.js exists in 2.x),eslint-plugin-importis still included, and our ESLint 8.56.0 satisfies the>=8peer requirement. Lint and tests pass unchanged.Co-Authored-By: Claude [email protected]