CVE-2026-118764

About vulnerability

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.

researcher: Reid Downing (b1nv0id) files:

• src/index.ts: 690-770
• src/index.ts: 780-796

issue: input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.

the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:

parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)

this occurs inside a do…while (didSomething) fixpoint loop, allowing generated entries to be processed again.

the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:

for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}

an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.

Affected product:

@0x/subproviders , @expo/build-tools , @expo/eas-build-job , @expo/steps , @expo/turtle-spawn , @graphql-cli/common , @ledgerhq/lumen-ui-rnative , @lg-tools/meta , @livekit/plugins-krisp-viva-internal , @pnpm/lockfile-file , @pnpm/lockfile-file-pnpm-lock-v6 , @portis/web3 , @portis/web3-provider-engine , @rnef/tools , @rushstack/rush-pnpm-kit-v8 , @vercel/queue , AlmaLinux 9.2 ESU , Alpine Linux 3.23 , Alpine Linux 3.24 , AngularJS , Babel , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Debian 12 , Debian 13 , Express , Fastify , Lodash , Next.js , Polymer/tools , Protocol Buffers , RHEL 7 ELS , React , RhysSullivan/executor , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Vue , adk-js , adobe-spectrum-component-api-schemas , adobe-spectrum-component-diff-generator , adobe-spectrum-design-data-mcp , adobe-spectrum-diff-core , adobe-token-diff-generator , aegir , agent-browser , agents-js , ai-sdk-harness-pi , ai-sdk-sandbox-just-bash , ai-sdk-workflow , ai-sdk-workflow-harness , allure-ava , allure-codeceptjs , allure-mocha , analogjs-platform , analogjs-storybook-angular , analogjs-vite-plugin-nitro , angular-compiler-cli , angular-create , angular-devkit-build-angular , angular-devkit-build-webpack , angular-eslint , angular-eslint-builder , angular-eslint-eslint-plugin , angular-eslint-eslint-plugin-template , angular-eslint-schematics , angular-eslint-template-parser , angular-eslint-test-utils , angular-eslint-utils , angular-localize , apollo , apollo-codegen-flow , apollo-codegen-scala , apollo-gateway , apollo-language-server , apollo-server , apollo-server-plugin-operation-registry , apollo-tooling , appium , appium-adb , appium-base-driver , appium-base-plugin , appium-chromedriver , appium-coresim , appium-eslint-config-appium-ts , appium-execute-driver-plugin , appium-fake-driver , appium-fake-plugin , appium-ios , appium-ios-device , appium-ios-remotexpc , appium-ios-simulator , appium-relaxed-caps-plugin , appium-remote-debugger , appium-support , appium-xcode , appkit , architect/utils , archiver-utils , ardatan-relay-compiler , asciidoctor-cli.js , asciidoctor-core , asciidoctor-opal-runtime , asciidoctor.js , assetgraph , assistant-ui , astrojs-netlify , astrojs-vercel , async-disk-cache , async-storage , augment-vir-test , ava , aws-cdk , axe-core-npm , axe-core-webdriverio , azion , babel-cli , babel-eslint , babel-eslint-parser , babel-jest , babel-loader , babel-plugin-emotion , babel-plugin-istanbul , babel-plugin-lodash , babel-plugin-module-resolver , babel-plugin-react-docgen , babel-plugin-remove-graphql-queries , babel-preset-expo , babel-register , babelify , basehub , beasties-webpack-plugin , berry , bestzip , bin-links , bitcoin-core , blockchain-link-utils , blocks-editor , blockstack.js , bls12377js , braintrust-openai-agents , braintrust-otel , braintrust-sdk-javascript , braintrust-temporal , broadcast-channel , broccoli , broccoli-amd-funnel , broccoli-babel-transpiler , broccoli-builder , broccoli-caching-writer , broccoli-clean-css , broccoli-concat , broccoli-config-loader , broccoli-config-replace , broccoli-debug , broccoli-es3-safe-recast , broccoli-es6modules , broccoli-file-creator , broccoli-filter , broccoli-funnel , broccoli-kitchen-sink-helpers , broccoli-merge-trees , broccoli-persistent-filter , broccoli-plugin , broccoli-sane-watcher , broccoli-sourcemap-concat , broccoli-stew , broccoli-string-replace , broccoli-writer , browser-sync , browserify , browserstack-local , buck-worker-tool , bugsnag-js , bull-board-fastify , bull-board-koa , bunyan , bunyan-debug-stream , bunyan-gke-stackdriver , bytecodealliance-jco-std , c8 , cacache , cache-loader , cacheable , callstack-repack , callstack/linaria , canvas , capacitor , casper-js-sdk , cdk-nag , cdk-serverless-clamscan , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-identity , celo-keystores , celo-phone-number-privacy-common , celo-utils , celo-wallet-base , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , chat-adapter-gchat , chialab-rna-saucelabs-test-runner , chromium-edge-launcher , cldr-data , clean-webpack-plugin , clerk-clerk-expo , clerk-expo , clerk-expo-biometrics , clerk-expo-google-signin , clerk-expo-native-components , clerk-expo-passkeys , clerk-upgrade , cli , cli-ux , cloud-sdk-js , codeceptjs , codecov , codeshift-core , codesmith , commit-analyzer , commitlint-cz-commitlint , commoner , componentizejs , components , compression-webpack-plugin , config , config-array , configure , confluent-kafka-javascript , consolidate.js , context-menu , copy-concurrently , copy-webpack-plugin , copyfiles , core-js-builder , cpr , cpy , create-assistant-ui , create-expo-module , create-factory , create-fumadocs-app , create-instantsearch-app , create-jest , create-module-federation , create-react-app , create-react-router , create-sanity , create-strapi , create-strapi-app , create-turbo , create-wdio , create-yarn-workspaces , crystal , cspell-cspell-tools , cspell-eslint-plugin , cspell-tools , css-loader , cucumber-js , cypress , cz-cli , cz-conventional-changelog , datadog-datadog-ci-base , datadog-mobile-react-native-code-push , davewasmer/devcert , debugnyan , decap-cms , definitelytyped , del , delete-empty , depcheck , depot , detective-typescript , detective-vue2 , dev-middleware , devcert , discordjs-node-pre-gyp , docsearch , documentation , docusaurus , docusaurus-core , docusaurus-mdx-loader , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , docusaurus-utils , docusaurus-utils-validation , doiuse , dotgitignore , dotignore , downlevel-dts , drizzle-orm , duckdb-node , e2b , e2b-cli , e2b-code-interpreter , e2b-dev/e2b , eas-cli , ecosystem , editorconfig-core-js , effect-docgen , ejs , electron-asar , electron-devtools-installer , electron-installer-common , electron-installer-debian , electron-installer-flatpak , electron-installer-redhat , electron-installer-snap , electron-mocha , electron-universal , electron-webpack , electron-webpack-js , ember-app-blueprint , ember-auto-import , ember-cli , ember-cli-babel , ember-cli-htmlbars , ember-cli-preprocess-registry , ember-cli-typescript , ember-modifier , ember-test-waiters , ember-tooling-blueprint-model , ember-try , ember.js , ember__application , embroider , embroider-addon-dev , embroider-compat , embroider-core , embroider-router , embroider-vite , emotion , endo , endo-bundle-source , endo-captp , endo-far , envelop , envelop-apollo-federation , envelop-newrelic , envelop-rate-limiter , enzyme-matchers , epub-gen-memory , epub-iconv-segment , epub-maker2 , eslint , eslint-community-eslint-plugin-eslint-comments , eslint-community/eslint-utils , eslint-compat-utils , eslint-config-airbnb-base , eslint-config-expo , eslint-config-fb-strict , eslint-config-ipfs , eslint-config-love , eslint-config-prettier , eslint-config-react-app , eslint-config-standard , eslint-config-turbo , eslint-config-universe , eslint-etc , eslint-import-resolver-typescript , eslint-js , eslint-loader , eslint-mcp , eslint-plugin-babel , eslint-plugin-compat , eslint-plugin-cypress , eslint-plugin-deprecation , eslint-plugin-es , eslint-plugin-es-x , eslint-plugin-eslint-comments , eslint-plugin-etc , eslint-plugin-expo , eslint-plugin-flowtype , eslint-plugin-formatjs , eslint-plugin-ft-flow , eslint-plugin-graphql , eslint-plugin-header , eslint-plugin-import , eslint-plugin-import-x , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsdoc , eslint-plugin-jsx-a11y , eslint-plugin-lit , eslint-plugin-lit-a11y , eslint-plugin-markdown , eslint-plugin-mobx , eslint-plugin-mocha , eslint-plugin-n , eslint-plugin-node , eslint-plugin-perfectionist , eslint-plugin-playwright , eslint-plugin-pnpm , eslint-plugin-prettier , eslint-plugin-promise , eslint-plugin-react , eslint-plugin-react-hooks , eslint-plugin-react-native , eslint-plugin-react-perf , eslint-plugin-react-refresh , eslint-plugin-redos , eslint-plugin-simple-import-sort , eslint-plugin-standard , eslint-plugin-storybook , eslint-plugin-testing-library , eslint-plugin-turbo , eslint-plugin-unicorn , eslint-plugin-unused-imports , eslint-plugin-verdaccio , eslint-plugin-vue , eslint-plugin-vuejs-accessibility , eslint-plugin-wc , eslint-plugin-wdio , eslint-plugin-yml , eslint-rewrite , eslint-stylistic , eslint-type-tracer , eslint-utils , eslint-webpack-plugin , eslintrc , esperanto , estree-to-babel , eth-block-tracker , eth-json-rpc-infura , eth-json-rpc-middleware , ethereumjs-client , ethersproject-cli , ethersproject-tests , event-pubsub , exec-buffer , executor , executor-js-config , executor-js-execution , executor-js-fumadb , executor-js-plugin-example , executor-js-plugin-file-secrets , executor-js-plugin-graphql , executor-js-plugin-keychain , executor-js-plugin-mcp , executor-js-plugin-onepassword , executor-js-plugin-openapi , expect-webdriverio , expo , expo-ads-admob , expo-ads-facebook , expo-app-auth , expo-app-integrity , expo-app-intents , expo-app-loading , expo-apple-authentication , expo-application , expo-asset , expo-audio , expo-auth-session , expo-av , expo-background-fetch , expo-background-task , expo-barcode-scanner , expo-battery , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-bunyan , expo-calendar , expo-camera , expo-cli , expo-clipboard , expo-config , expo-config-plugins , expo-configure-splash-screen , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-client-components , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-dev-tools , expo-device , expo-document-picker , expo-electron-adapter , expo-error-recovery , expo-expo-cli , expo-file-system , expo-fingerprint , expo-firebase-analytics , expo-firebase-core , expo-firebase-recaptcha , expo-font , expo-gl , expo-glass-effect , expo-google-app-auth , expo-haptics , expo-hinge , expo-image , expo-image-loader , expo-image-picker , expo-insights , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-local-build-cache-provider , expo-localization , expo-location , expo-logger , expo-mail-composer , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-autolinking , expo-modules-cli , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-notifications , expo-optimize , expo-package-manager , expo-payments-stripe , expo-permissions , expo-plugin-help , expo-prebuild-config , expo-print , expo-processing , expo-pwa , expo-random , expo-router , expo-router-server , expo-rudder-sdk-node , expo-screen-capture , expo-screen-orientation , expo-secure-store , expo-sensors , expo-sharing , expo-sms , expo-speech , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-store-review , expo-stories , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-test-runner , expo-tracking-transparency , expo-updates , expo-updates-interface , expo-vector-icons , expo-video , expo-video-thumbnails , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , expo/eas-cli , extract-css-chunks-webpack-plugin , facebook-create-react-app , facebook-lexical , facebook/react-native , fast-check , fast-check-packaged , fastly-http-compute-js , fbjs , fbjs-scripts , file-loader , file-set , file-utils , filelist , findup-sync , firebase-admin-node , firebase-functions , fireworm , fixturify , flat-cache , flow-api-translator , fly-import , forge , fork-ts-checker-webpack-plugin , friendly-errors-webpack-plugin , fs-jetpack , fs-merger , fs-vacuum , fstream , fstream-ignore , fstream-npm , fumadocs , fumadocs-epub , fumadocs-sanity , fumadocs-satteri , fumadocs-story , ganache-core , gapic-tools , gateway , gatsby , gatsby-cli , gatsby-cypress , gatsby-interface , gatsby-link , gatsby-page-utils , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-subfont , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , gax-nodejs , gaxios , gaze , gcp-metadata , gear , gear-lib , geckodriver , genkit , genkit-ai/genkit , gentle-fs , get-workspaces , gh-pages , git-rev-sync , github , glimmer-analyzer , glimmer-component , glimmer.js , glob , glob-promise , glob-stream , globalart-text-utils , globby , google-adk , google-adk-integrations , google-ai-generativelanguage , google-analytics-data , google-api-nodejs-client , google-auth-library , google-cloud-aiplatform , google-cloud-bigquery-storage-api , google-cloud-bigtable-api , google-cloud-cloud-sql-connector , google-cloud-containeranalysis , google-cloud-datacatalog , google-cloud-dataproc-metastore , google-cloud-datastore-api , google-cloud-deploy , google-cloud-financialservices , google-cloud-firestore , google-cloud-gke-connect-gateway , google-cloud-iot , google-cloud-kms , google-cloud-logging , google-cloud-logging-api , google-cloud-media-translation , google-cloud-monitoring , google-cloud-node , google-cloud-opentelemetry-cloud-monitoring-exporter , google-cloud-phishing-protection , google-cloud-pubsub , google-cloud-redis , google-cloud-spanner-api , google-cloud-speech , google-cloud-sql , google-cloud-text-to-speech , google-maps-isochrones , googleapis-common , googleapis-docs , googleapis-drive , googleapis-workspaceevents , gp-js-client , graphiql , graphiql-plugin-code-exporter , graphiql-plugin-collections , graphiql-plugin-doc-explorer , graphiql-plugin-history , graphiql-plugin-query-builder , graphiql-react , graphql-code-generator , graphql-codegen-client-preset , graphql-codegen-gql-tag-operations , graphql-codegen-typed-document-node , graphql-codegen-typescript , graphql-codegen-typescript-document-nodes , graphql-codegen-typescript-generic-sdk , graphql-codegen-typescript-graphql-request , graphql-codegen-typescript-jit-sdk , graphql-codegen-typescript-nhost , graphql-codegen-typescript-react-apollo , graphql-codegen-typescript-resolvers , graphql-codegen-typescript-rtk-query , graphql-config , graphql-hive-cli , graphql-hive-gateway , graphql-hive-gateway-testing , graphql-hive-plugin-opentelemetry , graphql-language-service-server , graphql-mesh , graphql-mesh-cli , graphql-mesh-compose-cli , graphql-mesh-fusion-composition , graphql-mesh-migrate-config-cli , graphql-mesh-openapi , graphql-mesh-plugin-snapshot , graphql-mesh-transform-filter-schema , graphql-mesh-transform-rate-limit , graphql-mesh-transport-sqlite , graphql-mesh-tuql , graphql-tools , graphql-tools-jest-transform , graphql-tools-relay-operation-optimizer , graphql-yoga-nestjs-federation , grpc-node , grunt , grunt-karma , gtoken , guess , gulp , hard-source-webpack-plugin , hardhat , hiero-sdk-js , hindsight , hooks , html-loader , html-webpack-plugin , html-webpack-skip-assets-plugin , html-webpack-tags-plugin , htmlnano , hydrate , i18next-cli , iarna-cli , ignore-walk , imagemin , imagemin-jpegtran , imagemin-optipng , imagemin-webp , import , init-package-json , inngest , inngest-ci , inngest-realtime , inngest-test , install-expo-modules , interface-datastore , inventory , ionic-cli , ionic-cli-framework , ionic-lab , ionic-v1-toolkit , is-git-clean , istanbul , istanbul-api , istanbul-instrumenter-loader , istanbul-lib-processinfo , istanbul-lib-source-maps , istanbuljs-nyc-config-babel , it , jake , jasmine-npm , jco , jest , jest-chain-transform , jest-circus , jest-cli , jest-config , jest-core , jest-environment , jest-environment-jsdom , jest-environment-jsdom-fourteen , jest-environment-node , jest-expect , jest-expo , jest-expo-enzyme , jest-globals , jest-haste-map , jest-image-snapshot , jest-jasmine2 , jest-preset-angular , jest-puppeteer-pkg , jest-repl , jest-reporters , jest-resolve-dependencies , jest-runner , jest-runtime , jest-snapshot , jest-specific-snapshot , jest-test-result , jest-test-sequencer , jest-transform , jest-validate , jest-watch-typeahead , joshwooding-vite-plugin-react-docgen-typescript , jovidecroock-prefresh , js-beautify , js-compute-runtime , js-ipfs-utils , js-libp2p-kad-dht , js-libp2p-websockets , jscodeshift , jscodeshift-add-imports , jscodeshift-find-imports , jsdoc-region-tag , jshint , jslint , json-rpc-engine , just-bash , just-bash-executor , karma , karma-browserstack-launcher , karma-coverage , karma-coverage-istanbul-reporter , karma-jasmine , karma-junit-reporter , karma-mocha-reporter , karma-requirejs , koa-views , kysely-org/kysely-typeorm , ladjs-consolidate , lazy-cacache , leafygreen-ui , leafygreen-ui-code , leafygreen-ui-date-picker , leafygreen-ui-select , leafygreen-ui-testing-lib , ledger-cosmos-js , ledger-live , ledgerhq-coin-framework , ledgerhq-coin-polkadot , ledgerhq-coin-sui , ledgerhq-coin-tester-bitcoin , ledgerhq-crypto-icons , ledgerhq-domain-service , ledgerhq-hw-app-exchange , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-native-ui , ledgerjs , lerna , lerna-rimraf-dir , less-loader , lg-charts-core , lg-tools-cli , lg-tools-codemods , lg-tools-create , lg-tools-install , lg-tools-link , lg-tools-prompt-kit , lg-tools-slackbot , lg-tools-storybook-addon , lg-tools-storybook-decorators , lg-tools-storybook-utils , lg-tools-test , lg-tools-validate , libcipm , libnpm , libnpmdiff , libnpmexec , libnpmfund , libnpmorg , libnpmversion , libp2p , libp2p-interface-compliance-tests , libp2p-interfaces-compliance-tests , libp2p-interop , libxmljs2 , liftoff , lighthouse , linaria , linaria-core , livekit-agents , livekit-agents-plugin-anam , livekit-agents-plugin-anthropic , livekit-agents-plugin-assemblyai , livekit-agents-plugin-azure , livekit-agents-plugin-baseten , livekit-agents-plugin-bey , livekit-agents-plugin-cartesia , livekit-agents-plugin-cerebras , livekit-agents-plugin-deepgram , livekit-agents-plugin-did , livekit-agents-plugin-elevenlabs , livekit-agents-plugin-fishaudio , livekit-agents-plugin-google , livekit-agents-plugin-hume , livekit-agents-plugin-inworld , livekit-agents-plugin-krisp , livekit-agents-plugin-lemonslice , livekit-agents-plugin-liveavatar , livekit-agents-plugin-livekit , livekit-agents-plugin-meta , livekit-agents-plugin-minimax , livekit-agents-plugin-mistral , livekit-agents-plugin-mistralai , livekit-agents-plugin-neuphonic , livekit-agents-plugin-perplexity , livekit-agents-plugin-phonic , livekit-agents-plugin-protoface , livekit-agents-plugin-resemble , livekit-agents-plugin-rime , livekit-agents-plugin-sarvam , livekit-agents-plugin-silero , livekit-agents-plugin-soniox , livekit-agents-plugin-tavus , livekit-agents-plugin-trugen , livekit-agents-plugin-xai , livekit/agents-js , livestore , lnfs , load-plugin , loaders.gl-tile-converter , lock-verify , logtape-adaptor-bunyan , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , lottie-react-native , lynx-js-genui , lynx-js-i18next-translation-dedupe , lynx-js-rspeedy , magic-js , make-fetch-happen , maptiler-sdk-js , markdownlint-cli , mastra , mastra-auth-firebase , mastra-blaxel , mastra-braintrust , mastra-code-sdk , mastra-e2b , mastra-factory , mastra-google-cloud-pubsub , mastra-inngest , mastra-livekit , mastra-mesa , mastra-spanner , mastracode , matcher-collection , mathjax-src , mdit-plugins , mdx , medplum-cdk , medplum-eslint-config , mem-fs-editor , mercurius , mercurius-federation , mercuriusjs-gateway , metalsmith , metalsmith-in-place , metamask-core , metamask-snaps-cli , metamask-snaps-jest , metro , metro-cache , metro-config , metro-transform-worker , microsoft-365-agents-toolkit , microsoft-rush , microsoft-rush-lib , middleware , mikro-orm-reflection , mikro-orm-sqlite , mini-css-extract-plugin , minifier , minimatch , minimizer-webpack-plugin , minizlib , mjml-core , mjmlio/mjml , mocha , modelcontextprotocol-codemod , modelling , modern-js-adapter-rstest , modern-js-app-tools , modern-js-babel-plugin-module-resolver , modern-js-dev/modern.js , modern-js-generator-utils , modern-js-plugin-bff , modern-js-plugin-polyfill , modern-js-server , modern-js-server-utils , modern-js-uni-builder , modern.js , module-deps , module-federation-core , monaco-graphql , mongodb , mongodb-js-devtools-connect , mongodb-js-eslint-config-devtools , mongodb-js-mongodb-schema , mongodb-js-mongodb-ts-autocomplete , mongodb-js-monorepo-tools , mongodb-js/mongosh , mongosh , mongosh-autocomplete , mongosh-editor , mongosh-logging , mongosh-shell-evaluator , monorepo , move-concurrently , move-file , mui-codemod , mui-internal-docs-utils , mui-internal-scripts , mui-material-pigment-css , multimatch , mux-mux-elements-codemod , mysten-docs , mysten-gcp-kms-signer , mysten-signers , nde , neostandard , nestjs-mercurius , nestjs-typeorm , netlify-build , netlify-build-info , netlify-cms , netlify-cms-app , netlify-dev , netlify-edge-bundler , netlify-functions-dev , netlify-functions-utils , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , netlify-zip-it-and-ship-it , netlify/functions , nft , ng-packagr , ngrx-eslint-plugin , nguniversal , nitro , nitroparty , noble , node-activedirectory , node-archiver , node-bluetooth-hci-socket , node-dir , node-elm-compiler , node-fileset , node-fixturify-project , node-fs-extra , node-fs-updater , node-globule , node-gyp , node-ipc , node-ldapjs , node-merge-trees , node-mv , node-native-metrics , node-newrelic , node-novel-fetch-file-or-url , node-novel-imagemin , node-plop , node-pre-gyp , node-quick-temp , node-readdir-glob , node-sass , node-sdk , node-simctl , node-tap , node-tar , node-temp , node-temp-fs , node-walk-sync , node-zip-stream , nodejs-proto-files , nodemon , nomicfoundation-hardhat-ethers , novel-epub , npm , npm-check , npm-check-updates , npm-init2 , npm-lifecycle , npm-package-json-lint , npm-package-json-loader , npm-packlist , npm-profile , npm-registry-client , npm-registry-fetch , npm:@nestjs/sequelize , npm:@pnpm/exec.lifecycle , npm:@pnpm/exec.prepare-package , npm:gatsby-theme-blog-core , npm:grover , npm:libnpmpack , npmcli-arborist , npmcli-config , npmcli-map-workspaces , npmcli-metavuln-calculator , npmcli-package-json , null-loader , nuxt , nuxt-devtools , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nx , nx-angular , nx-angular-rspack , nx-angular-rspack-compiler , nx-cypress , nx-detox , nx-devkit , nx-docker , nx-esbuild , nx-eslint , nx-eslint-plugin , nx-expo , nx-express , nx-jest , nx-js , nx-maven , nx-module-federation , nx-nest , nx-next , nx-node , nx-oxlint , nx-playwright , nx-plugin , nx-react , nx-react-native , nx-rollup , nx-rsbuild , nx-rspack , nx-storybook , nx-vite , nx-vitest , nx-vue , nx-web , nx-webpack , nx-workspace , nyc , oclif-plugin-autocomplete , oclif-plugin-not-found , oclif-plugin-plugins , oclif-plugin-search , oclif-plugin-skills-flag , oclif-plugin-version , oclif-plugin-warn-if-update-available , oclif-plugin-which , oclif/core , octanejs-docusaurus , office-addin-debugging , office-addin-dev-settings , officeparser , offline-plugin , omnigraph-openapi , onflow-fcl-react-native , onnxruntime-common , open-wc , open-wc-building-rollup , open-wc-building-utils , open-wc-building-webpack , open-wc-demoing-storybook , open-wc-eslint-config , open-wc-testing , open-wc-testing-karma , open-wc-testing-karma-bs , openapi-typescript , openapitools-openapi-generator-cli , opencensus-node , opencode , opencode-ai , opencode-plugin , opencode-plugin-browser , opencode-sdk , opencode-simulation , opencode-util , openidconnect , opentelemetry-auto-instrumentations-node , opentelemetry-resource-detector-gcp , opentui-solid , optimize-css-assets-webpack-plugin , opus , orama-orama , orval , orval-angular , orval-axios , orval-core , orval-effect , orval-fetch , orval-hono , orval-labs/orval , orval-mcp , orval-mock , orval-pinia-colada , orval-query , orval-solid-start , orval-swr , pack-n-play , packager , pacote , panda , pandacss-dev , pandacss-eslint-plugin , pandacss-extractor , pandacss-mcp , pandacss-node , pandacss-parser , pandacss-postcss , parcel , parcel-bundler , parcel-fs , patch-package , patch-project , pdfjs-dist , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-core , percy-webdriverio , pi , pigment-css , pkg-utils , pkgs , playwright , playwright-chromium , playwright-core , playwright-firefox , playwright-test , playwright-test-scoped , playwright-webkit , plugin-commands , plugin-help , plugin-update , plugin-warn-if-update-available , plugins , pm2 , pnpm , pnpm-building.after-install , pnpm-cache.commands , pnpm-deps.compliance.license-scanner , pnpm-deps.compliance.sbom , pnpm-deps.inspection.commands , pnpm-deps.status , pnpm-engine.pm.commands , pnpm-engine.runtime.commands , pnpm-eslint-config , pnpm-fetching.binary-fetcher , pnpm-fetching.directory-fetcher , pnpm-fetching.git-fetcher , pnpm-fetching.tarball-fetcher , pnpm-fs.packlist , pnpm-installing.client , pnpm-installing.context , pnpm-installing.deps-installer , pnpm-installing.package-requester , pnpm-lockfile.settings-checker , pnpm-lockfile.verification , pnpm-releasing.commands , pnpm-store.commands , pnpm-store.controller , pnpm-store.pkg-finder , pnpm-sync , pnpm-workspace.commands , pnpm-workspace.injected-deps-syncer , polkadot-api-docgen , postcss-functions , postcss-loader , postcss-single-charset , postcss-url , powersync-nuxt , pprof , precinct , prefresh-webpack , pretty , prettyhtml , probe.gl , processing-js , progress-bar-webpack-plugin , promises-tests , prompt , protons , protractor , publishr , puppeteer , puppeteer-core , purgecss , query , qunit , qwik , racejar , raw-loader , read-installed , read-package-json , read-package-tree , recursive-readdir , redoc , redocly-cli , redocly-openapi-core , redocly-respect-core , regenerator , rehype-cli , relay , release-notes-generator , remark-cli , remirror , remirror/remirror , remix , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-maptiler , remove , repack , resolution-map-builder , resp-modifier , rewrite , rimraf , ripple-ts-adapter-vercel , rna , rnx-kit , rock-js-plugin-expo-config-plugins , rock-js-template-default , rollup-plugin-copy , rollup-plugin-index-html , rollup-plugin-workbox , rsbuild-plugin-i18next-extractor , rsbuild-plugin-stylus , rsbuild-plugin-type-check , rspack-cli , rspack-dev-server , rspack-test-tools , rspress , rules_nodejs , run-script , runtime-cli , rushstack , rushstack-eslint-config , rushstack-eslint-plugin , rushstack-eslint-plugin-packlets , rushstack-eslint-plugin-security , rushstack-hashed-folder-copy-plugin , rushstack-heft-jest-plugin , rushstack-heft-node-rig , rushstack-heft-vscode-extension-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , rushstack-lockfile-explorer , rushstack-package-extractor , rushstack-rush-cli-client , rushstack-webpack-plugin-utilities , rushstack-webpack4-localization-plugin , rushstack-webpack4-module-minifier-plugin , rxjs-report-usage , safe-global-testing-kit , sander , sane , sanity , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-cli-test , sanity-codegen , sanity-export , sanity-io/cli , sanity-migrate , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-template-validator , sanity-tsdown-config , sanity-vercel-protection-bypass , sanity-vision , sanity-workbench-cli , sass-graph , sass-loader , sauce-connect-launcher , sb , schema-utils , sdk-typescript , selenium , semantic-release , semantic-release-changelog , semantic-release-git , semantic-release-monorepo , semantic-release-npm , semantic-release-plugin-decorators , sentry-astro , sentry-aws-serverless , sentry-bun , sentry-bundler-plugin-core , sentry-effect , sentry-electron , sentry-elysia , sentry-ember , sentry-esbuild-plugin , sentry-eslint-config-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-javascript , sentry-javascript-bundler-plugins , sentry-nestjs , sentry-nextjs , sentry-nitro , sentry-node , sentry-node-native , sentry-nuxt , sentry-profiling-node , sentry-react-router , sentry-remix , sentry-rollup-plugin , sentry-solidstart , sentry-sveltekit , sentry-tanstackstart-react , sentry-typescript , sentry-vite-plugin , sentry-webpack-plugin , sequelize-typescript , serialize-to-js , serve , serve-handler , services , shadcn , shadcn-registry , shelljs , shifter , shikijs-vitepress-twoslash , sigmacomputing-babel-plugin-lodash , sigstore-cli , sigstore-js , sigstore-oci , sigstore-sign , size-plugin , smithy-service-client-documentation-generator , solc , solidjs-start , sorcery , sort-package-json , sort-package-json3 , spawn-wrap , spectrum-tokens , sqlite3 , squarelink-web3 , stacks-auth , standard-changelog , standard-version , static-config , storybook , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-interactions , storybook-angular , storybook-blocks , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core , storybook-core-client , storybook-core-common , storybook-core-server , storybook-core-webpack , storybook-docs-tools , storybook-ember , storybook-experimental-nextjs-vite , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-html-webpack , storybook-preset-preact-webpack , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-preset-vue3-webpack , storybook-react , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-tanstack-react , storybook-telemetry , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-email , strapi-i18n , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-review-workflows , strapi-strapi , strapi-types , strapi-upload , strong-error-handler , strong-globalize , strong-globalize-cli , strong-remoting , stryker-mutator-core , stryker-mutator-typescript-checker , stryker-mutator-vitest-runner , stx-labs-stacks.js , stx-labs/stacks.js , style-loader , style-resources-loader , stylelint , stylelint-no-unsupported-browser-features , stylistic-eslint-plugin-js , stylistic-eslint-plugin-jsx , stylistic-eslint-plugin-plus , stylistic-eslint-plugin-ts , stylus , stylus-loader , subfont , sucrase , surma-rollup-plugin-off-main-thread , svelte-preprocess , sveltedoc-parser , sveltejs-adapter-vercel , svgicons2svgfont , svgr , sw-precache , swagger-api-apidom-ls , swagger-api-apidom-reference , swagger-js , swagger-ui , sync-disk-cache , tailwindcss , tanstack-ai-sandbox-blaxel , tanstack-ember-hotkeys , tanstack-ember-pacer , tanstack-ember-table , tanstack-eslint-plugin-query , tanstack-expo-db-sqlite-persistence , tanstack-query-broadcast-client-experimental , tanstack-router , tape , tar-pack , temporalio-create , temporalio-google-adk-agents , tempy , test-exclude , testcafe-browser-tools , testcafe-hammerhead , testcafe-legacy-api , testem , testing-library-vue , theme-ui , thread-loader , throws-transformer-ts , tiged , time-fix-plugin , tldts-tests , tmp , tools , transloadit , transloadit-mcp-server , tree-sync , trezor-connect-web , trezor-env-utils , trezor-suite , trickfilm400-rollup-plugin-off-main-thread , trivago-prettier-plugin-sort-imports , true-case-path , ts-checker-rspack-plugin , ts-jest , ts-json-schema-generator , ts-loader , ts-morph , ts-sdks , tsdoc , tslint , tslint-consistent-codestyle , tsrx-eslint-parser , tsrx-eslint-plugin , tuf-js , tufjs-cli , tufjs-repo-mock , tuql , turbo-codemod , turbo-gen , turbo-types , turbo-workspaces , twoslash , twoslashes/twoslash , typedoc , typedoc-github-wiki-theme , typedoc-plugin-coverage , typedoc-plugin-extras , typedoc-plugin-frontmatter , typedoc-plugin-markdown , typedoc-plugin-mdn-links , typedoc-plugin-mermaid , typedoc-plugin-missing-exports , typedoc-plugin-remark , typedoc-vitepress-theme , typeorm , typescript-eslint , typescript-eslint-eslint-plugin , typescript-eslint-parser , typescript-eslint-rule-schema-to-typescript-types , typescript-eslint-rule-tester , typescript-eslint-type-utils , typescript-eslint-typescript-estree , typescript-plugin-css-modules , uglifyjs-webpack-plugin , uncss , unified-args , unified-engine , unimodules-task-manager-interface , unleash-client , unocss-eslint-config , unocss-eslint-plugin , unzipper , update-versions , uploadfs , uppy-companion , url-loader , urltools , utile , vechain-sdk-js , vercel , vercel-backends , vercel-build-utils , vercel-cervel , vercel-client , vercel-elysia , vercel-express , vercel-fastify , vercel-fs-detectors , vercel-gatsby-plugin-vercel-builder , vercel-h3 , vercel-hono , vercel-hydrogen , vercel-introspection , vercel-koa , vercel-nestjs , vercel-next , vercel-node , vercel-python , vercel-python-analysis , vercel-react-router , vercel-redwood , vercel-remix-builder , vercel-sandbox-mock , vercel-static-build , verdaccio , verdaccio-api , verdaccio-audit , verdaccio-auth , verdaccio-auth-memory , verdaccio-aws-s3-storage , verdaccio-cli , verdaccio-core , verdaccio-eslint-config , verdaccio-loaders , verdaccio-local-storage , verdaccio-local-storage-legacy , verdaccio-logger , verdaccio-node-api , verdaccio-package-filter , verdaccio-plugin-verifier , verdaccio-proxy , verdaccio-search , verdaccio-server , verdaccio-signature , verdaccio-store , verdaccio-tarball , verdaccio-test-helper , verdaccio-url , verdaccio-utils , verdaccio-web , vetur , vincentdchan/webpack-deep-scope-analysis-plugin , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , vinyl-fs , virmator , virmator-docs , virmator-plugin-testing , virmator-publish , virmator-test , vite-plugin-checker , vite-plugin-istanbul , vitest , vitest-browser , vitest-coverage-istanbul , vitest-coverage-v8 , vitest-eslint-plugin , vitest-ui , vitest-webdriverio , volar-vscode , vscode-languageserver-node , vscode-vsce , wallet-adapter , watch-detector , waterline , wdio , wdio-ai-service , wdio-allure-reporter , wdio-appium-service , wdio-browser-runner , wdio-browserstack-service , wdio-cli , wdio-concise-reporter , wdio-config , wdio-crossbrowsertesting-service , wdio-cucumber-framework , wdio-devtools-backend , wdio-devtools-service , wdio-dot-reporter , wdio-electrobun-service , wdio-electron-service , wdio-elements , wdio-firefox-profile-service , wdio-globals , wdio-image-comparison-core , wdio-jasmine-framework , wdio-junit-reporter , wdio-lighthouse-service , wdio-local-runner , wdio-mocha-framework , wdio-ocr-service , wdio-runner , wdio-sauce-service , wdio-session , wdio-shared-store-service , wdio-snapshot , wdio-spec-reporter , wdio-sumologic-reporter , wdio-tauri-service , wdio-testingbot-service , wdio-utils , wdio-visual-service , wdio-webdriver-mock-service , web-dev-server-storybook , web-rollup-plugin-copy , web-rollup-plugin-html , web-storybook-builder , web-storybook-framework-web-components , web-test-runner , web-test-runner-browserstack , web-test-runner-chrome , web-test-runner-junit-reporter , web-test-runner-puppeteer , web-test-runner-saucelabs , web-test-runner-webdriver , web3-provider-engine , web3-react , web3providerengine , webdav , webdriver , webdriver-js-extender , webdriver-manager , webdriverio , webdriverio-devtools , webdriverio/devtools , webpack , webpack-assets-manifest , webpack-cli , webpack-cli-generators , webpack-dev-middleware , webpack-dev-server , webpack-filter-warnings-plugin , webpack-manifest-plugin , webpack-plugin-serve , webpack-subresource-integrity , webpackbar , windows-installer , with-zephyr , wordpress-create-block , wordpress-e2e-tests , wordpress-env , wordpress-eslint-plugin , wordpress-jest-console , wordpress-jest-preset-default , wordpress-npm-package-json-lint-config , wordpress-scripts , workbox , worker-loader , workflow , workflow-ai , workflow-astro , workflow-builders , workflow-cli , workflow-core , workflow-nest , workflow-next , workflow-nitro , workflow-nuxt , workflow-rollup , workflow-sveltekit , workflow-vite , workflow-vitest , workflow-web , workflow-web-shared , workflow-world-local , workflow-world-postgres , workflow-world-testing , workflow-world-vercel , workflows , wotan , ws-segment , wyw-in-js , wyw-in-js-babel-preset , wyw-in-js-bun , wyw-in-js-cli , wyw-in-js-esbuild , wyw-in-js-parcel-transformer , wyw-in-js-processor-utils , wyw-in-js-rollup , wyw-in-js-shared , wyw-in-js-transform , wyw-in-js-turbopack-loader , wyw-in-js-vite , wyw-in-js-webpack-loader , xataio-client-ts , xdl , yam , yaml.js , yarn-tool-fix-all , yarn-tool-ncu , yarn-tool-ncu-ws , yarn-tool-pack-package , yarn-tool-run-script-lifecycle , yarnpkg-cli , yarnpkg-doctor , yarnpkg-plugin-catalog , yarnpkg-plugin-compat , yarnpkg-plugin-constraints , yarnpkg-plugin-dlx , yarnpkg-plugin-essentials , yarnpkg-plugin-interactive-tools , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-plugin-pnpm , yarnpkg-plugin-typescript , yarnpkg-plugin-version , yarnpkg-plugin-workspace-tools , yeoman-api , yeoman-generator , yeoman-transform , yeoman/environment , yui-lint , yuidoc , yurnalist , zbsearch-plugin-docusaurus , zbsearch-plugin-parsedoc , zephyr-modernjs-plugin , zephyr-nuxt-module , zestedesavoir/zmarkdown , zkochan-rimraf , zmarkdown

Affected packages:

rust @ 1.89 (+23984 more)