Skip to content

Conversation

@EinfachHans
Copy link

Summary

This PR updates glob to v12.0.0 to fix #15892 and the CVE behind it (GHSA-5j98-mcp5-4vw2).

This CVE is marked as high and should be fixed immediately. Sadly glob v11 dropped support for node < 20 and jest still supports 18. I guess this means the support for 18 has to be dropped and this will then be a major release? Please let me know what you think about this.

Test plan

Green CI

@netlify
Copy link

netlify bot commented Nov 18, 2025

Deploy Preview for jestjs ready!

Built without sensitive environment variables

Name Link
🔨 Latest commit 4afe6f2
🔍 Latest deploy log https://app.netlify.com/projects/jestjs/deploys/691c420f4d8c080008871ec0
😎 Deploy Preview https://deploy-preview-15894--jestjs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@linux-foundation-easycla
Copy link

CLA Not Signed

@pkg-pr-new
Copy link

pkg-pr-new bot commented Nov 18, 2025

Open in StackBlitz

babel-jest

npm i https://pkg.pr.new/babel-jest@15894

babel-plugin-jest-hoist

npm i https://pkg.pr.new/babel-plugin-jest-hoist@15894

babel-preset-jest

npm i https://pkg.pr.new/babel-preset-jest@15894

create-jest

npm i https://pkg.pr.new/create-jest@15894

@jest/diff-sequences

npm i https://pkg.pr.new/@jest/diff-sequences@15894

expect

npm i https://pkg.pr.new/expect@15894

@jest/expect-utils

npm i https://pkg.pr.new/@jest/expect-utils@15894

jest

npm i https://pkg.pr.new/jest@15894

jest-changed-files

npm i https://pkg.pr.new/jest-changed-files@15894

jest-circus

npm i https://pkg.pr.new/jest-circus@15894

jest-cli

npm i https://pkg.pr.new/jest-cli@15894

jest-config

npm i https://pkg.pr.new/jest-config@15894

@jest/console

npm i https://pkg.pr.new/@jest/console@15894

@jest/core

npm i https://pkg.pr.new/@jest/core@15894

@jest/create-cache-key-function

npm i https://pkg.pr.new/@jest/create-cache-key-function@15894

jest-diff

npm i https://pkg.pr.new/jest-diff@15894

jest-docblock

npm i https://pkg.pr.new/jest-docblock@15894

jest-each

npm i https://pkg.pr.new/jest-each@15894

@jest/environment

npm i https://pkg.pr.new/@jest/environment@15894

jest-environment-jsdom

npm i https://pkg.pr.new/jest-environment-jsdom@15894

@jest/environment-jsdom-abstract

npm i https://pkg.pr.new/@jest/environment-jsdom-abstract@15894

jest-environment-node

npm i https://pkg.pr.new/jest-environment-node@15894

@jest/expect

npm i https://pkg.pr.new/@jest/expect@15894

@jest/fake-timers

npm i https://pkg.pr.new/@jest/fake-timers@15894

@jest/get-type

npm i https://pkg.pr.new/@jest/get-type@15894

@jest/globals

npm i https://pkg.pr.new/@jest/globals@15894

jest-haste-map

npm i https://pkg.pr.new/jest-haste-map@15894

jest-jasmine2

npm i https://pkg.pr.new/jest-jasmine2@15894

jest-leak-detector

npm i https://pkg.pr.new/jest-leak-detector@15894

jest-matcher-utils

npm i https://pkg.pr.new/jest-matcher-utils@15894

jest-message-util

npm i https://pkg.pr.new/jest-message-util@15894

jest-mock

npm i https://pkg.pr.new/jest-mock@15894

@jest/pattern

npm i https://pkg.pr.new/@jest/pattern@15894

jest-phabricator

npm i https://pkg.pr.new/jest-phabricator@15894

jest-regex-util

npm i https://pkg.pr.new/jest-regex-util@15894

@jest/reporters

npm i https://pkg.pr.new/@jest/reporters@15894

jest-resolve

npm i https://pkg.pr.new/jest-resolve@15894

jest-resolve-dependencies

npm i https://pkg.pr.new/jest-resolve-dependencies@15894

jest-runner

npm i https://pkg.pr.new/jest-runner@15894

jest-runtime

npm i https://pkg.pr.new/jest-runtime@15894

@jest/schemas

npm i https://pkg.pr.new/@jest/schemas@15894

jest-snapshot

npm i https://pkg.pr.new/jest-snapshot@15894

@jest/snapshot-utils

npm i https://pkg.pr.new/@jest/snapshot-utils@15894

@jest/source-map

npm i https://pkg.pr.new/@jest/source-map@15894

@jest/test-result

npm i https://pkg.pr.new/@jest/test-result@15894

@jest/test-sequencer

npm i https://pkg.pr.new/@jest/test-sequencer@15894

@jest/transform

npm i https://pkg.pr.new/@jest/transform@15894

@jest/types

npm i https://pkg.pr.new/@jest/types@15894

jest-util

npm i https://pkg.pr.new/jest-util@15894

jest-validate

npm i https://pkg.pr.new/jest-validate@15894

jest-watcher

npm i https://pkg.pr.new/jest-watcher@15894

jest-worker

npm i https://pkg.pr.new/jest-worker@15894

pretty-format

npm i https://pkg.pr.new/pretty-format@15894

commit: 4afe6f2

@BenjaminBLarsen
Copy link

Glob 11.1.0 should be patched. Maybe that still has support for node 18.

GHSA-5j98-mcp5-4vw2

@EinfachHans
Copy link
Author

@BenjaminBLarsen the fix is only in glob 11.1.0.
glob 11.0.0 drops the support for node 18: https://github.com/isaacs/node-glob/blob/main/changelog.md

@SimenB
Copy link
Member

SimenB commented Nov 18, 2025

glob 10.5 was released 9 hours ago, so this is not needed.

https://github.com/isaacs/node-glob/commits/v10/

thanks for the PR, tho!

@SimenB SimenB closed this Nov 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: glob high CVE-2025-64756

3 participants