nx
Nx
GitHub
Nx
Workspace
GitHub
CI Pipeline Executions
Current execution
Failed
NXC-4762
Timeline
Configuration
Self-Healing CI
Project Graph
Resource Usage
Analysis
Conformance
Runs
Current run
Succeeded
Tasks
Resource Usage
Insights
Compare tasks
Analytics
Sign in
Toggle sidebar
fix(core): replace minimatch with picomatch nx and several plugins depend on minimatch, which pulls brace-expansion (GHSA-rgw5-rvv9-x895 DoS, third CVE in that package this year). All minimatch usages replaced with picomatch (nx, devkit, jest, playwright, react, rsbuild). minimatch, brace-expansion and balanced-match leave the published nx runtime dependency closure. Not pure 1:1: - picomatch only lets a leading `**/` match zero path segments in standalone patterns, not inside `{a,b}` brace alternation, so combineGlobPatterns output missed root-level files. New splitGlobPatterns() (local copy in devkit for the +/-1 nx major compat contract); jest plugin and project-glob-changes pass pattern arrays instead. - picomatch throws on empty patterns and invalid makeRe input where minimatch returned false/null: guards added at the affected sites. - `!(x)` is a real extglob now (micromatch semantics), which makes the min-release-age yarn matcher closer to yarn's own behavior. Dev-tree transitives (eslint, glob, verdaccio, typedoc) still pull minimatch, so the pnpm overrides stay; brace-expansion override bumped to 5.0.9 (the patched version). Fixes NXC-4762
nx-cloud record -- nx sync:check
⌘K
Succeeded
nx-cloud record -- nx sync:check
Click to copy
Linux
4 CPU cores
78c914c5
36567