From 9647b86e20b5b3e7c56d26ba711b66c133757079 Mon Sep 17 00:00:00 2001 From: Sangjoon Han Date: Mon, 2 Nov 2026 03:49:10 +0900 Subject: [PATCH 1/4] chore(deps): override moment to ^2.31.0 (GHSA-4p3w-j4w9-5jqw) `obsidian` pins `moment` to exactly 2.29.4, so Dependabot's security update for alert #35 fails with "latest possible version ... is 2.29.4". Force the patched release with an npm `overrides` entry instead. `moment` is only consumed for the type declarations in obsidian.d.ts; src/ never imports it and esbuild never bundles it (Obsidian provides its own copy at runtime). Type-check and lint pass, and the production main.js / styles.css are byte-identical before and after. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 6 +++--- package.json | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index d161b2b..9abed65 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3731,9 +3731,9 @@ "license": "MIT" }, "node_modules/moment": { - "version": "2.29.4", - "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz", - "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==", + "version": "2.31.0", + "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz", + "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 477f200..32b8c54 100644 --- a/package.json +++ b/package.json @@ -33,5 +33,8 @@ "tslib": "^2.6.0", "typescript": "^5.6.3", "typescript-eslint": "^8.62.0" + }, + "overrides": { + "moment": "^2.31.0" } } From 10a2b81f2294e6a6901ad38b34eec8ab26dfa39e Mon Sep 17 00:00:00 2001 From: Sangjoon Han Date: Mon, 2 Nov 2026 03:50:16 +0900 Subject: [PATCH 2/4] chore: sync package.json version to 1.2.2 and enforce it in validate The release docs already said to keep package.json's version in sync with manifest.json, but nothing checked it, and it stayed at 1.1.5 through the 1.2.0, 1.2.1 and 1.2.2 releases. Bump package.json / package-lock.json to 1.2.2 and make scripts/validate.mjs fail CI when either disagrees with manifest.version. List the package.json bump (`npm version --no-git-tag-version`) as an explicit step in CONTRIBUTING.md, docs/DEVELOPMENT.md, CLAUDE.md and the release PR checklist. Co-Authored-By: Claude Opus 5.5 --- .github/PULL_REQUEST_TEMPLATE/release.md | 4 +++- CLAUDE.md | 2 +- CONTRIBUTING.md | 2 ++ docs/DEVELOPMENT.md | 11 ++++++----- package-lock.json | 4 ++-- package.json | 2 +- scripts/validate.mjs | 15 +++++++++++++++ 7 files changed, 30 insertions(+), 10 deletions(-) diff --git a/.github/PULL_REQUEST_TEMPLATE/release.md b/.github/PULL_REQUEST_TEMPLATE/release.md index bd257a1..f007de2 100644 --- a/.github/PULL_REQUEST_TEMPLATE/release.md +++ b/.github/PULL_REQUEST_TEMPLATE/release.md @@ -5,7 +5,8 @@ Open it from the dev...main compare with: ?expand=1&template=release.md (base: main, compare: dev) -Bump manifest.json + versions.json + CHANGELOG.md on `dev` BEFORE opening this +Bump manifest.json + package.json/package-lock.json + versions.json + +CHANGELOG.md on `dev` BEFORE opening this PR. On merge, the Release workflow auto-tags `main` and publishes the release. --> @@ -21,6 +22,7 @@ PR. On merge, the Release workflow auto-tags `main` and publishes the release. ## Pre-merge checklist - [ ] `manifest.json` `version` is set to **X.Y.Z** +- [ ] `package.json` / `package-lock.json` `version` is **X.Y.Z** (`npm version X.Y.Z --no-git-tag-version`) - [ ] `versions.json` has `"X.Y.Z": ""` (matches `manifest.minAppVersion`) - [ ] `CHANGELOG.md` has a dated `## [X.Y.Z]` section (moved out of *Unreleased*) - [ ] `node --check main.js` and `node scripts/validate.mjs` pass locally diff --git a/CLAUDE.md b/CLAUDE.md index 070e628..a72ee0b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -71,4 +71,4 @@ Lookout moves Obsidian-owned nodes (the svg, the table) into its own wrappers an - Default branch is **`dev`** — branch off it (`feat/*`, `fix/*`, `docs/*`, `chore/*`) and open PRs against `dev`, never `main`. Use Conventional Commits. - `main` only receives merges from `dev` or `hotfix/*`. **Releases are automatic on merge to `main`**: the workflow reads `version` from `manifest.json` and pushes a bare-version tag (no `v` prefix — Obsidian convention). -- A version bump must touch three files in lockstep (validated by `scripts/validate.mjs`): `manifest.json` (`version`), `versions.json` (`"": ""`, which must equal `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` notes into a dated section). +- A version bump must touch these files in lockstep: `manifest.json` (`version`), `package.json` + `package-lock.json` (`version`, must equal the manifest — use `npm version --no-git-tag-version`), `versions.json` (`"": ""`, which must equal `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` notes into a dated section). `scripts/validate.mjs` enforces all but the CHANGELOG. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ebd13bf..dc5b822 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,6 +111,8 @@ The version bump lands on `dev` first: 1. On a branch off `dev`, prepare the release: - bump `version` in `manifest.json`, + - bump `package.json` / `package-lock.json` to the same version + (`npm version --no-git-tag-version`), - add the matching entry to `versions.json` (`"": ""`), - move the `Unreleased` notes in [`CHANGELOG.md`](CHANGELOG.md) into a dated `## []` section. diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index 7c2e097..05be7bb 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -171,8 +171,9 @@ Summarised here; the authoritative version is in on merge to `main`**: the workflow installs deps, builds `main.js`, reads `version` from `manifest.json`, pushes a bare-version tag (no `v` prefix — Obsidian convention), and uploads `main.js` / `manifest.json` / `styles.css`. -- A version bump touches three files in lockstep (checked by - `scripts/validate.mjs`): `manifest.json` (`version`) — keep `package.json`'s - `version` in sync — `versions.json` (`"": ""`, equal to - `manifest.minAppVersion`), and `CHANGELOG.md` (move `Unreleased` into a dated - section). +- A version bump touches these files in lockstep: `manifest.json` (`version`), + `package.json` + `package-lock.json` (`version`, equal to the manifest — run + `npm version --no-git-tag-version`), `versions.json` + (`"": ""`, equal to `manifest.minAppVersion`), and + `CHANGELOG.md` (move `Unreleased` into a dated section). + `scripts/validate.mjs` checks every one of these except the CHANGELOG. diff --git a/package-lock.json b/package-lock.json index 9abed65..3319853 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "lookout", - "version": "1.1.5", + "version": "1.2.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "lookout", - "version": "1.1.5", + "version": "1.2.2", "license": "MIT", "devDependencies": { "@types/node": "^20.14.0", diff --git a/package.json b/package.json index 32b8c54..765d081 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "lookout", - "version": "1.1.5", + "version": "1.2.2", "description": "Survey wide content instead of scrolling sideways — pan/zoom Mermaid diagrams and open wide tables full-screen in Obsidian.", "main": "main.js", "private": true, diff --git a/scripts/validate.mjs b/scripts/validate.mjs index dd088e9..8a58b9b 100644 --- a/scripts/validate.mjs +++ b/scripts/validate.mjs @@ -56,6 +56,21 @@ if (manifest && versions) { } } +// package.json / package-lock.json carry the same version. Nothing reads it at +// runtime, which is exactly why it drifted unnoticed (stuck at 1.1.5 through +// 1.2.0–1.2.2); check it so a release bump can't forget it again. +if (manifest) { + for (const f of ["package.json", "package-lock.json"]) { + try { + const v = JSON.parse(readFileSync(f, "utf8")).version; + if (v === manifest.version) ok(`${f} version matches manifest (${v})`); + else fail(`${f} version "${v}" != manifest.version "${manifest.version}"`); + } catch (e) { + fail(`${f} unreadable: ${e.message}`); + } + } +} + /* * styles.css: properties Obsidian's plugin CSS check rejects. * From d4987779cd9831c10e9b47b7cf82dba06eb5204c Mon Sep 17 00:00:00 2001 From: Sangjoon Han Date: Mon, 2 Nov 2026 03:50:16 +0900 Subject: [PATCH 3/4] docs: refresh stale notes in CLAUDE.md and dependabot.yml - src/main.ts is ~1,850 lines now, not ~900. - dependabot.yml still described the plugin as "plain CommonJS with no build step", which predates the TypeScript + esbuild toolchain. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 5 +++-- CLAUDE.md | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 302f1e6..ea7a7e2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,8 @@ version: 2 updates: - # Keep GitHub Actions used in workflows up to date. (The plugin itself has - # no runtime dependencies — it ships as plain CommonJS with no build step.) + # Keep GitHub Actions used in workflows up to date. (The plugin has no + # runtime dependencies — `obsidian` is host-provided and never bundled — so + # npm only gets Dependabot *security* updates for the dev toolchain.) - package-ecosystem: github-actions directory: "/" schedule: diff --git a/CLAUDE.md b/CLAUDE.md index a72ee0b..10c5a8d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -43,7 +43,7 @@ A note containing a wide Mermaid diagram and a wide table exercises both feature ## Architecture -Everything lives in `src/main.ts` (~900 lines), three classes: +Everything lives in `src/main.ts` (~1,850 lines), three classes: - **`LookoutPlugin`** (the `default` export) — lifecycle and **discovery**. It finds rendered Mermaid ``s (`.mermaid svg, svg[id^="mermaid-"]`) and ``s anywhere in the document and wraps each in a view. Discovery is driven by several overlapping triggers because Mermaid renders asynchronously and Obsidian re-renders panes on navigation: `onLayoutReady`, workspace events (`layout-change`, `active-leaf-change`, `file-open`), a `registerMarkdownPostProcessor`, and a `MutationObserver` on `document.body`. All of these funnel through `queueScan()` (debounced ~120ms) → `scan()` → `scanWithin(root)` → `process()` / `processTable()`. - **`DiagramView`** — one pan/zoom controller per diagram. The same class serves both the **inline** frame (wraps the live svg in place) and **full-screen** (wraps a *clone* in a fixed overlay). It owns the transform math: `_measure`, `fit`, `actualSize`, `zoomTo`/`zoomBy`, `_panBounds`/`_clampPan`, and `_render`. From a94ea2eb30b66fb0f1ed851c5a9f5fe11052ece3 Mon Sep 17 00:00:00 2001 From: Sangjoon Han Date: Mon, 2 Nov 2026 04:00:36 +0900 Subject: [PATCH 4/4] chore(deps): override minimatch to ^11.0.1 where the API allows (GHSA-g3hv-75wg-m249) The globParts-amplification DoS is only fixed in minimatch 11.0.1, and no upstream release (not even eslint 10) accepts 11, so Dependabot's security update fails. Override minimatch to ^11.0.1 under the consumers that only use the named `Minimatch` / `minimatch` exports, which 11 keeps: eslint, @eslint/config-array, @eslint/eslintrc, @typescript-eslint/typescript-estree, eslint-plugin-n This replaces the copies that actually contain the vulnerable code (9.0.9, 10.2.5) and moves ESLint's own file/config matching to 11.0.3. Left alone on purpose: eslint-plugin-import / eslint-plugin-react (3.x) and eslint-plugin-json-schema-validator (8.x, pinned by eslint-plugin-obsidianmd) call the module itself or its default export. minimatch >= 10 exports a plain object, so forcing 11 there would crash them. 3.x predates the vulnerable preprocessing, and the json-schema-validator rules are not enabled for src/. A callable shim via a `file:` override was tried and dropped: npm 11 resolves `file:` overrides relative to each consumer, which produces broken links. Verification: - differential test, minimatch 3.1.5 vs 11.0.3, on the option sets ESLint and eslint-plugin-n pass: 3300 cases, only diffs are patterns containing `..` (11 normalizes them), which our config does not use - `eslint --print-config src/main.ts` is identical before and after, and the same files are linted - full CI gate passes; production main.js is unaffected (dev toolchain only) Rationale and removal criteria are documented in docs/DEVELOPMENT.md. Co-Authored-By: Claude Opus 5.5 --- docs/DEVELOPMENT.md | 24 +++++++ package-lock.json | 170 ++++++++++++++++++++++++++++++++++++++++---- package.json | 17 ++++- 3 files changed, 196 insertions(+), 15 deletions(-) diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md index 05be7bb..09ab52b 100644 --- a/docs/DEVELOPMENT.md +++ b/docs/DEVELOPMENT.md @@ -121,6 +121,30 @@ relaxation: **`strictPropertyInitialization` is off**, because the view classes initialize their fields in `_build()` / `_buildToolbar()` rather than the constructor body. `strictNullChecks`, `noImplicitAny`, etc. remain on. +### Dependency `overrides` (dev toolchain security pins) + +`package.json` `overrides` force patched versions that upstream ranges block. +None of them reach `main.js` — they only affect the lint/type-check toolchain. + +- **`moment` → `^2.31.0`** (GHSA-4p3w-j4w9-5jqw). `obsidian` pins `moment` to + exactly `2.29.4`; it is only used for the type declarations. +- **`minimatch` → `^11.0.1`** under `eslint`, `@eslint/config-array`, + `@eslint/eslintrc`, `@typescript-eslint/typescript-estree` and + `eslint-plugin-n` (GHSA-g3hv-75wg-m249 — only 11.0.1+ is patched, and no + upstream release accepts 11 yet). These consumers only use the named + `Minimatch` / `minimatch` exports, which 11 keeps. + + The override is **not** applied to `eslint-plugin-import` / `eslint-plugin-react` + (minimatch 3.x) or `eslint-plugin-json-schema-validator` (8.x): they call the + module itself (`minimatch(…)` / default import), and minimatch ≥ 10 exports a + plain object, so 11 would crash them. 3.x predates the vulnerable + `globParts` preprocessing entirely, and the `json-schema-validator` rules are not + enabled for `src/`. That is why the GitHub alert for this advisory can still + list those copies. + +Drop an override once the upstream range covers the patched version +(`npm ls --all` shows the tree). After changing one, re-run the full CI gate. + ## Code guidelines (Obsidian) Keep changes within Obsidian's plugin guidelines: diff --git a/package-lock.json b/package-lock.json index 3319853..4b2b87b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -574,6 +574,46 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/@eslint/config-array/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/@eslint/config-array/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/@eslint/config-array/node_modules/minimatch": { + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/@eslint/config-helpers": { "version": "0.4.2", "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz", @@ -624,6 +664,46 @@ "url": "https://opencollective.com/eslint" } }, + "node_modules/@eslint/eslintrc/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/@eslint/eslintrc/node_modules/minimatch": { + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/@eslint/js": { "version": "9.39.4", "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", @@ -753,6 +833,13 @@ "url": "https://github.com/sponsors/nzakas" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "dev": true, + "license": "BlueOak-1.0.0" + }, "node_modules/@marijn/find-cluster-break": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.2.tgz", @@ -1093,13 +1180,14 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { - "version": "10.2.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", - "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==", + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.5" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { "node": "18 || 20 || >=22" @@ -2296,14 +2384,27 @@ "eslint": ">=8.23.0" } }, + "node_modules/eslint-plugin-n/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, "node_modules/eslint-plugin-n/node_modules/brace-expansion": { - "version": "2.1.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", - "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { - "balanced-match": "^1.0.0" + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" } }, "node_modules/eslint-plugin-n/node_modules/globals": { @@ -2320,16 +2421,17 @@ } }, "node_modules/eslint-plugin-n/node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", "dev": true, - "license": "ISC", + "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^2.0.2" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { - "node": ">=16 || 14 >=14.17" + "node": "18 || 20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" @@ -2516,6 +2618,46 @@ "url": "https://opencollective.com/eslint" } }, + "node_modules/eslint/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/eslint/node_modules/brace-expansion": { + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/eslint/node_modules/minimatch": { + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", diff --git a/package.json b/package.json index 765d081..b7b1fec 100644 --- a/package.json +++ b/package.json @@ -35,6 +35,21 @@ "typescript-eslint": "^8.62.0" }, "overrides": { - "moment": "^2.31.0" + "moment": "^2.31.0", + "eslint": { + "minimatch": "^11.0.1" + }, + "@eslint/config-array": { + "minimatch": "^11.0.1" + }, + "@eslint/eslintrc": { + "minimatch": "^11.0.1" + }, + "@typescript-eslint/typescript-estree": { + "minimatch": "^11.0.1" + }, + "eslint-plugin-n": { + "minimatch": "^11.0.1" + } } }