Repository navigation
Repair the docs dependency audit for minimatch GHSA-g3hv-75wg-m249 #224
Description
The docs job fails npm audit --audit-level=moderate because Eleventy 3.1.7 resolves @11ty/recursive-copy 4.0.4 to vulnerable minimatch 3.1.5. The audit reports GHSA-g3hv-75wg-m249, including the two parent packages in the dependency chain. Observed in SDK #219 CI. The same docs lock is on main.
General owns a separate docs dependency correction so the main build does not wait for #219's backend qualification. Keep the moderate audit threshold. Prefer a scoped minimatch override for the existing copy package, whose actual call site uses the supported minimatch.match() API. Qualify the generated docs, copied assets, portal checks and normal browser CI. No PHP runtime or package-release change is needed.
Activity
rmcdaniel commentedon Nov 2, 2026
Delivered through protected PR #225 as
456147a703359de65e29829ee73844501a1009ce. All 42 source checks completed: 41 success and one intended skip, with zero open Sonar findings. Normal main CI, developer portal deployment, Sonar, boundary and CodeQL follow-through passed.The scoped override leaves
npm audit --audit-level=moderateenabled and reports zero vulnerabilities. Actual recursive-copy checks cover brace globs, nested assets, negative filters and unrelated extensions. Full local docs generation validates 374 pages, 16 guide destinations, links and analytics; hosted CI also runs fresh installs and browser checks. The private docs manifest declares the resolved Node 20 / 22+ toolchain; PHP requirements and source are unchanged.The merged remote head was deleted and its absence verified with HTTP 404. SDK #219 inherited this repair through a normal main merge at
034c0f4dc2fbbc1671fe9b1cdfd0fa36c2576c2e; its PHP source and tests match the previously qualified67ecbef5exactly. Its native #931 acceptance remains separate and pending.