Urgent - Security Vulnerability

[Sydney-o9]

Description

Summary

@sentry/node depends on minimatch ^9.0.3, which has a known ReDoS vulnerability.

Vulnerability

• CVE: GHSA-3ppc-4f35-3m26
• Severity: High
• Issue: ReDoS via repeated wildcards with non-matching literal in pattern
• Fixed in: minimatch 10.2.1+

Request

Please upgrade minimatch dependency from ^9.0.3 to ^10.2.1 in @sentry/node.

Impact

Affects @sentry/nextjs and all packages depending on @sentry/node.

References

GHSA-3ppc-4f35-3m26

[linear]

JS-1778

[andreiborza]

Hey thanks for filing this, we're on it: #19452