[khucanhduy9-cloud]

Updates

• Affected products

Comments
The advisory names firstPhasePreProcess() with optimizationLevel >= 2 as the vulnerable code path. firstPhasePreProcess() first appears in minimatch 7.0.0, where preprocessing runs it unconditionally; the optimizationLevel gate was added in 7.1.0. Neither exists in any earlier line: the latest releases 3.1.5, 4.2.6, 5.1.9 and 6.2.3 contain neither firstPhasePreProcess nor optimizationLevel. The current range < 11.0.1 therefore flags 0.x–6.x, which do not contain the affected code. Those lines are still widely locked through ESLint (eslint, @eslint/eslintrc, @eslint/config-array, eslint-plugin-import, eslint-plugin-jsx-a11y, eslint-plugin-react declare ^3.1.x). The patched release is 11.x only, and the 11.x README says the new matcher will not be backported, so npm audit / pnpm audit users on those lines cannot resolve the finding. Please confirm with the maintainer and narrow the range to >= 7.0.0, < 11.0.1.

[github]

Hi there @isaacs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory