Skip to content

fix: CVE-2026-26996 in docs#924

Closed
loadez wants to merge 1 commit intomainfrom
fix/CVE-2026-26996
Closed

fix: CVE-2026-26996 in docs#924
loadez wants to merge 1 commit intomainfrom
fix/CVE-2026-26996

Conversation

@loadez
Copy link
Copy Markdown
Contributor

@loadez loadez commented Mar 12, 2026

No description provided.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1dd36cd4e5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread docs/package-lock.json
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
"version": "3.1.3",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep minimatch compatible with exact serve-handler pin

Updating node_modules/minimatch to 3.1.3 makes the lockfile internally inconsistent because serve-handler@6.1.6 still requires minimatch exactly 3.1.2 in the same package-lock.json; running npm ls --package-lock-only minimatch in docs/ now reports invalid: "3.1.2" and exits with ELSPROBLEMS. This leaves the docs lockfile in an invalid state for npm-based validation workflows and can cause future installs to churn or revert this security bump.

Useful? React with 👍 / 👎.

@loadez loadez closed this Apr 1, 2026
@loadez loadez deleted the fix/CVE-2026-26996 branch April 1, 2026 14:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Backlog

Development

Successfully merging this pull request may close these issues.

1 participant