Run details

NxWorkspace

CI Pipeline Executions
Runs
- Current runSucceeded
- Tasks
- Resource Usage

Insights

Compare tasks
Analytics

Sign in

fix(core): replace minimatch with picomatch nx and several plugins depend on minimatch, which pulls brace-expansion (GHSA-rgw5-rvv9-x895 DoS, third CVE in that package this year). All minimatch usages replaced with picomatch (nx, devkit, jest, playwright, react, rsbuild). minimatch, brace-expansion and balanced-match leave the published nx runtime dependency closure. Not pure 1:1: - picomatch only lets a leading `**/` match zero path segments in standalone patterns, not inside `{a,b}` brace alternation, so combineGlobPatterns output missed root-level files. New splitGlobPatterns() (local copy in devkit for the +/-1 nx major compat contract); jest plugin and project-glob-changes pass pattern arrays instead. - picomatch throws on empty patterns and invalid makeRe input where minimatch returned false/null: guards added at the affected sites. - `!(x)` is a real extglob now (micromatch semantics), which makes the min-release-age yarn matcher closer to yarn's own behavior. Dev-tree transitives (eslint, glob, verdaccio, typedoc) still pull minimatch, so the pnpm overrides stay; brace-expansion override bumped to 5.0.9 (the patched version). Fixes NXC-4762

nx run-many -t check-imports check-lock-files check-codeowners --parallel=1 --no-dte

Succeeded

4 CPU cores

read-write access token used

78c914c536567

Get faster results

Learn how to enable distribution.

Atomizer enabled

1 group of tasks optimized.

© 2026 - Nx Cloud

Terms of Service Privacy Policy Changelog Status Docs Contact Nx Cloud Pricing Company @NxDevTools