Repository navigation
fix: replace fast-glob with tinyglobby to drop braces (CVE-2026-93687) @W-24615276@ - #1069
Merged
k80bowman merged 1 commit intoOct 22, 2026
Conversation
fast-glob pulls in micromatch -> braces@3.0.3, which is flagged by CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm. No patched braces release exists and the upstream maintainer disputes the CVE, so the only way to clear it for consumers (including @salesforce/cli) is to drop the dependency. tinyglobby (fdir + picomatch) has no braces dependency and is already in the sf CLI dependency tree via @oclif/plugin-plugins. The new globPaths helper preserves fast-glob's output contract: - absolute patterns return absolute paths (tinyglobby returns cwd-relative) - directories have no trailing slash - results are ordered pattern-by-pattern (tinyglobby interleaves) @types/picomatch is added as a devDependency because fdir's typings import picomatch (same approach as oclif/core).
|
Thanks for the contribution! It looks like @jontg is an internal user so signing the CLA is not required. However, we need to confirm this. |
k80bowman
approved these changes
Oct 22, 2026
k80bowman
left a comment
k80bowman
left a comment
Contributor
There was a problem hiding this comment.
Thank you for taking care of this! I checked the CI tests on a separate branch, they all passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Replaces
fast-globwithtinyglobbyinsrc/shared/fs.ts.fast-glob→micromatch→braces@3.0.3is flagged by an open CVE, CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm. The CVE is disputed upstream (micromatch/braces#70) and no patched release exists, so we can't wait for a fix. Dropping the dependency clears it for@salesforce/cli.tinyglobbyusesfdir+picomatch(nobraces) and is already in the sf CLI dependency tree through@oclif/plugin-plugins.A straight swap would change the output, so a small
globPathshelper keeps the existing behavior:globPaths../../…)objectsobjects/objects@types/picomatchis added as a devDependency becausefdir's typings importpicomatch(same approach asoclif/core).Testing
yarn test(compile, lint, unit tests, command-reference, deprecation policy) passes.test/nuts/fs.nut.tspasses 4/4. It exercises all three changed functions againstsample-project-multiple-packages.fast-globimplementations and the new functions side by side on a fixture project with relative,., absolute, cwd-outside-project and multi-package-dir inputs. All outputs, including order, are identical.yarn why bracesshowsbracesonly via dev dependencies (oclif,@salesforce/dev-scripts).What issues does this PR fix or reference?
bracesfrom@salesforce/cliruntime deps. The other two paths are@salesforce/apex-node(forcedotcom/salesforcedx-apex) and@salesforce/packaging(forcedotcom/packaging). Follow-up PRs will go to those repos.