@microsoft/api-extractor - npm Package Compare versions

Comparing version 7.52.9 to 7.52.10

CHANGELOG.md

 # Change Log - @microsoft/api-extractor
 
-This log was last generated on Wed, 23 Jul 2025 20:55:57 GMT and should not be manually modified.
+This log was last generated on Fri, 01 Aug 2025 00:12:48 GMT and should not be manually modified.
 
+## 7.52.10
+Fri, 01 Aug 2025 00:12:48 GMT
+
+### Patches
+
+- Upgrades the minimatch dependency from ~3.0.3 to 10.0.3 across the entire Rush monorepo to address a Regular Expression Denial of Service (ReDoS) vulnerability in the underlying brace-expansion dependency.
+
 ## 7.52.9
@@ -6,0 +13,0 @@ Wed, 23 Jul 2025 20:55:57 GMT

dist/tsdoc-metadata.json

@@ -8,5 +8,5 @@ // This file is read by tools that parse documentation comments conforming to the TSDoc standard.
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.52.8"
+      "packageVersion": "7.52.9"
     }
   ]
 }

lib/collector/Collector.js

@@ -37,5 +37,2 @@ "use strict";
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -47,3 +44,3 @@ exports.Collector = void 0;
 const api_extractor_model_1 = require("@microsoft/api-extractor-model");
-const minimatch_1 = __importDefault(require("minimatch"));
+const minimatch_1 = require("minimatch");
 const ExtractorMessageId_1 = require("../api/ExtractorMessageId");
@@ -143,3 +140,3 @@ const CollectorEntity_1 = require("./CollectorEntity");
                 for (const dependencyName of dependencyNames) {
-                    if ((0, minimatch_1.default)(dependencyName, packageNameOrPattern)) {
+                    if ((0, minimatch_1.minimatch)(dependencyName, packageNameOrPattern)) {
                         resolvedPackageNames.add(dependencyName);
@@ -146,0 +143,0 @@ }

package.json

 {
   "name": "@microsoft/api-extractor",
-  "version": "7.52.9",
+  "version": "7.52.10",
   "description": "Analyze the exported API for a TypeScript library and generate reviews, documentation, and .d.ts rollups",
@@ -38,3 +38,3 @@ "keywords": [
     "lodash": "~4.17.15",
-    "minimatch": "~3.0.3",
+    "minimatch": "10.0.3",
     "resolve": "~1.22.1",
@@ -45,4 +45,4 @@ "semver": "~7.5.4",
     "@microsoft/api-extractor-model": "7.30.7",
+    "@rushstack/rig-package": "0.5.3",
     "@rushstack/node-core-library": "5.14.0",
-    "@rushstack/rig-package": "0.5.3",
     "@rushstack/terminal": "0.15.4",
@@ -52,10 +52,9 @@ "@rushstack/ts-command-line": "5.0.2"
   "devDependencies": {
-    "@rushstack/heft": "0.74.0",
+    "@rushstack/heft": "0.74.1",
     "@types/lodash": "4.14.116",
-    "@types/minimatch": "3.0.5",
     "@types/resolve": "1.20.2",
     "@types/semver": "7.5.0",
     "eslint": "~9.25.1",
-    "local-eslint-config": "1.0.0",
-    "decoupled-local-node-rig": "1.0.0"
+    "decoupled-local-node-rig": "1.0.0",
+    "local-eslint-config": "1.0.0"
   },
@@ -62,0 +61,0 @@ "scripts": {

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2010078

0.03%

Dev dependency count

7

-12.5%

Lines of code

25324

0.04%

Dependency changes

• + Added

  @isaacs/balanced-match@4.0.1
  (transitive)

• + Added

  @isaacs/brace-expansion@5.0.0
  (transitive)

• + Added

  minimatch@10.0.3
  (transitive)

• - Removed

  balanced-match@1.0.2
  (transitive)

• - Removed

  brace-expansion@1.1.12
  (transitive)

• - Removed

  concat-map@0.0.1
  (transitive)

• - Removed

  minimatch@3.0.8
  (transitive)

• Updated

  minimatch@10.0.3