Skip to content

Conversation

@bjoernricks
Copy link
Contributor

What

Update glob from 10.4.5 to 10.5.0

Why

Fix a security issue in the glob package by updating to the latest release that includes the fix.

References

https://jira.greenbone.net/browse/GEA-1386

Fix a security issue in the glob package by updating to the latest
release that includes the fix.
@bjoernricks bjoernricks requested a review from a team as a code owner November 20, 2025 13:22
@github-actions
Copy link

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 22b2dbe.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/glob 10.5.0 🟢 4.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 3/29 approved changesets -- score normalized to 1
Maintained🟢 1019 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • package-lock.json

@greenbonebot greenbonebot enabled auto-merge (rebase) November 20, 2025 13:22
@greenbonebot greenbonebot merged commit 34b0d90 into main Nov 20, 2025
22 checks passed
@greenbonebot greenbonebot deleted the fix-glob-security-issue branch November 20, 2025 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants