-
Notifications
You must be signed in to change notification settings - Fork 99
fix: Update glob to 10.5.0 to address CVE-2025-64756 - #1591
Draft
MarcAstr0 wants to merge 4 commits into
Draft
Conversation
Force all glob dependencies to use version 10.5.0 or higher via pnpm hook to prevent command injection vulnerability (CVE-2025-64756) that affects glob versions 10.2.0 through 10.4.x. The vulnerability allows arbitrary command execution when the glob CLI tool is used with the -c/--cmd flag and processes files with malicious names. While this primarily affects CLI usage, updating ensures no security scanners will flag vulnerable versions in the dependency tree. Changes: - Updated .pnpmfile.cjs hook to override vulnerable glob versions - Regenerated pnpm-lock.yaml with glob 10.5.0 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
@MarcAstr0
MarcAstr0
added
the
do not merge
This PR can be approved, but not merged yet
label
Nov 24, 2025
PR Summary
- Upgrade of 'glob' dependency version
This update boosts the security of our application by addressing a potential weakness, called command injection vulnerability, that was discovered in certain versions of the 'glob' dependency we use. This vulnerability has been officially identified by number CVE-2025-64756. We've upgraded from those susceptible versions to version '10.5.0' to eliminate this risk. This action puts our users' data safety at top priority, ensuring our software continues to provide trustworthy service.
MarcAstr0
commented
Nov 24, 2025
Collaborator
Author
/integration sha=224dfd7
Contributor
⌛ Integration tests are running...
Check their status here 👈
Contributor
❌ Oh no! Integration tests have failed
Fix type error caused by stricter type checking in @types/node 20.19.x where RequestOptions.headers could be OutgoingHttpHeaders or readonly string array. Added explicit type cast to OutgoingHttpHeaders when setting Content-Length header. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Force all glob dependencies to use version 10.5.0 or higher via pnpm hook to prevent command injection vulnerability (CVE-2025-64756) that affects glob versions 10.2.0 through 10.4.x.
The vulnerability allows arbitrary command execution when the glob CLI tool is used with the -c/--cmd flag and processes files with malicious names. While this primarily affects CLI usage, updating ensures no security scanners will flag vulnerable versions in the dependency tree.
Changes:
🤖 Generated with Claude Code
Description
Changes
Checks