Vulnerability in dependencies "minimatch" <10.2.1

[danwater]

minimatch <10.2.1
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - GHSA-3ppc-4f35-3m26

It appears that this application depends on "minimatch" 3.1.2 which is now listed as having a known vulnerability. I did try overriding the package to the fixed version but the API has changed and breaks functionality.

See above for the advisory and CVE: CVE-2026-26996

[remy]

bump going up in the next release

[lkraav]

This missed bumping engine requirements to Node 18+, because now on Node 16, nodemon-3.1.12+ won't install, breaking reasonable ^ constraints like ^3.1.11.

$ npm --workspaces=false install --package-lock-only
npm ERR! code EBADENGINE
npm ERR! engine Unsupported engine
npm ERR! engine Not compatible with your version of node/npm: minimatch@10.2.4
npm ERR! notsup Not compatible with your version of node/npm: minimatch@10.2.4
npm ERR! notsup Required: {"node":"18 || 20 || >=22"}
npm ERR! notsup Actual:   {"npm":"8.19.4","node":"v16.20.2"}

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/node/.npm/_logs/2026-03-21T14_28_38_848Z-debug-0.log