Repository navigation
fix(deps): Bump glob to 14 and drop the direct dependency from react-router - #26014
Merged
Merged
Conversation
Fixes GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch, pulled in at ^11 by glob 14).
Fixes GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch, pulled in at ^11 by glob 14).
Co-Authored-By: GPT-6 <codex@openai.com>
…rward slashes React Router resolves `buildDirectory` with the platform separator, so on Windows the default `filesToDeleteAfterUpload` pattern contained backslashes. glob reads those as escape characters, the pattern never matched, and the uploaded source maps were kept in the build output. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
glob 14 pulls in minimatch 11, whose matcher was rewritten with changed extglob semantics. The rollup upload patterns rely on `?(\?*)?(#*)`, so exercise that suffix against the real matcher. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Keeps `pnpm audit` from flagging GHSA-3g3m-2fjr-6pw4 through a package we control. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
size-limit report 📦Compared: 5e65e67 (PR test merge using develop at 21ca39b) Against: 21ca39b (develop) · base run #64732 ✅ Baseline matches: this diff contains only this PR's changes.
|
Contributor
Optional E2E testsSome optional checks were not successful. They do not block the merge. 6 not successful, 49 successful. See the run.
Successful checks
|
Member
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 0baa211. Configure here.
chargome
marked this pull request as ready for review
November 3, 2026 10:27
chargome
requested review from
a team,
Lms24,
andreiborza,
isaacs,
logaretm,
nicohrubec and
s1gr1d
and removed request for
a team,
Lms24,
isaacs and
logaretm
November 3, 2026 10:27
andreiborza
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why:
npm auditflagsglob@13andminimatch@10in@sentry/bundler-pluginsand@sentry/react-router. Only glob 14 fixes this. This PR takes over #25981 (@renantatsuo) and #25982 (@nicohrubec) with their commits kept, and adds two fixes on top:globFilesfrom the bundler plugins instead of its ownglobdependency.filesToDeleteAfterUploadpattern used the raw build directory path. On Windows that contains backslashes, which glob treats as escapes, so source maps were never deleted after upload. The path is now converted to forward slashes.The
browser-integration-testsdev dependency is bumped as well. glob 13 stays in the lockfile throughnx,rimrafand@vercel/nft, which are all dev-only.How to review: The bump and
globFilescommits are unchanged from the original PRs. Look at the forward-slash fix inhandleOnBuildEnd.tsand the newglob.test.tscase that runs the upload patterns against the new minimatch 11 matcher.Closes #25969
🤖 Generated with Claude Code