chore(deps): update dependency minimatch@3>brace-expansion to v5 by renovate[bot] · Pull Request #76 · timoa/workflow-metrics

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.71%. Comparing base (5dc1d28) to head (0fab97e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #76   +/-   ##
=======================================
  Coverage   92.71%   92.71%           
=======================================
  Files           6        6           
  Lines         741      741           
  Branches      227      235    +8     
=======================================
  Hits          687      687           
  Misses         54       54

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

timoa · 2026-08-11T19:41:36Z

🛑 DevSecOps Renovate sweep (TIM-117) — CI gate

Required check Lint, Test, Build & Security is failing on this PR, so the autopilot is skipping it. The CI gate requires a fully green rollup before auto-merge.

Please investigate the failing check (or re-run it after fixes) and re-trigger the sweep if appropriate.

🤖 Automated by DevSecOps autopilot

timoa · 2026-08-12T00:02:01Z

DevSecOps autopilot (TIM-119) — skipped: CI gate failed (dependency-review FAILURE; cflite-pr, CodeQL-Build, Detect changes CANCELLED). minimatch@3 transitive bump via brace-expansion — patch-level but CI is broken/cancelled. Please rebase and re-run.

timoa · 2026-08-13T00:03:04Z

Skipping — CI is red on this PR (🚫 dependency-review, multiple other checks cancelled). Same root cause as PR #77: a v2→v5 transitive leap of brace-expansion forced via pnpm-workspace.yaml for the minimatch@3 dep path. Not auto-merged; please triage the CI failure and confirm the v2→v5 jump is intended.

timoa · 2026-08-14T00:02:25Z

Renovate PR — DevSecOps sweep (2026-08-14).

CI gate failure blocks auto-merge. Failed check(s):

Lint, Test, Build & Security

This is a major version bump (brace-expansion 1.1.16 → 5.0.9, transitive via minimatch@3). Please fix the failing checks. The next sweep will re-evaluate once CI is green.

timoa · 2026-08-15T00:02:38Z

Renovate sweep — skipped, blocked. MAJOR bump (minimatch@3>brace-expansion 1.1.16 → 5.0.9) and CI gate failure: Lint, Test, Build & Security is FAILING. Major version jump (four majors!) with breaking changes (ESM-only since 3.0.0, new balancing algorithm in 4.0.0). Please investigate the failing CI and either fix and merge, or close.

timoa · 2026-08-16T00:04:08Z

Autopilot: minimatch@3>brace-expansion 1.1.16 → 5.0.9 (major bumps v1 → v5, three majors at once). CI blocked: Lint, Test, Build & Security = FAILURE. Please investigate the lint failure and re-run CI before merging.

timoa · 2026-08-17T00:02:34Z

DevSecOps sweep: skipping — required check 'Lint, Test, Build & Security' is FAILING. brace-expansion 1.1.16 → 5.0.9 (transitive of minimatch@3) is a MAJOR bump; v5 changed to ES Modules, which commonly breaks CJS call sites. Please triage and rerun.

timoa

Renovate daily sweep (DevSecOps autopilot, 2026-08-18): this PR updates brace-expansion 1.1.16 → 5.0.9 (transitive via minimatch@3, MAJOR delta). Branch name renovate/minimatch3-brace-expansion-5.x confirms major. Per the autopilot risk-tier policy, major bumps require human approval. CI is also failing on Lint, Test, Build & Security (other checks green). Files: pnpm-lock.yaml + pnpm-workspace.yaml (no package.json change). Skipping auto-merge — please review and address both blockers manually.

timoa · 2026-08-19T00:02:44Z

Daily Renovate sweep: blocked. minimatch@3>brace-expansion 1.1.16 → 5.0.9 is a major bump (v1 → v5 — multiple major versions including an ESM-only v3), and the Lint, Test, Build & Security check failed. Major-version bumps also require human approval per policy. Please review, fix CI, and merge manually.

timoa · 2026-08-20T00:01:56Z

Skipping — CI gate failure: Lint, Test, Build & Security FAILED on this PR. PR bumps transitive brace-expansion 1.1.16 → 5.0.9 (via minimatch@3) (major) and rewrites pnpm-workspace.yaml outside the lockfile. Please triage the failing checks before merging.

timoa

DevSecOps daily sweep: classifying as major (brace-expansion 1.1.16 → 5.0.9, transitively pulled in by minimatch@3). Major version jump + CI failing (Lint, Test, Build & Security FAILURE). Skipping auto-merge; requesting human review and a rebase.

timoa · 2026-08-22T00:02:18Z

DevSecOps sweep TIM-173: skipped — failing CI. Lint, Test, Build & Security failed. minimatch@3>brace-expansion 1.1.16 → 5.0.9 (major). CI gate blocks auto-merge. Please fix CI and re-run, or merge manually once green.

timoa · 2026-08-23T00:01:36Z

DevSecOps auto-merge is blocked: Lint, Test, Build & Security check failed on the latest run (FAILURE). PR: transitive brace-expansion v1.1.16 → v5.0.9 under minimatch@3 (major). Major bump on a transitive dependency via pnpm overrides — please confirm the override entry is still needed and rerun CI.

timoa

This PR is auto-flagged for human review.

PR #76 bumps brace-expansion (via minimatch@3) from 1.1.16 to 5.0.9 — a major bump (skipping 2, 3, 4). Major bumps require human approval.

CI status: Lint, Test, Build & Security is FAILING. Same v5 brace-expansion behavior change applies here; the failures are likely related. Please review and merge manually if acceptable after triaging the lint breakage.

timoa

DevSecOps autopilot: skipped — MAJOR bump (brace-expansion 1.1.16 → 5.0.9) AND CI failing (Lint, Test, Build & Security = FAILURE). Big version jump through several majors (including ESM-only v3 and v5); please review the breaking changes and the failing build before merging.

timoa · 2026-08-29T00:05:20Z

DevSecOps autopilot sweep (2026-08-29). CI failed (Lint, Test, Build & Security) — skipping. lockfile-only change would otherwise be auto-mergeable; please rebase and re-run, then re-evaluate on the next daily sweep.

timoa · 2026-08-30T00:06:10Z

🤖 Renovate autopilot (DevSecOps, daily sweep @ 2026-08-30):

Skipped — CI gate failure (and major version bump). Required check Lint, Test, Build & Security is FAILING.

This PR bumps transitive brace-expansion from v1.1.16 (via minimatch@3) to v5.0.9 (MAJOR — 1.x → 5.x). Lockfile + pnpm-workspace.yaml only — no workflow files. Major-version updates require human approval.

Action needed: Fix the CI failure on main of workflow-metrics first. Once green, manually verify this transitive bump does not break minimatch v3 consumers; the autopilot does not auto-merge major bumps even when CI is green.

timoa · 2026-10-15T00:02:22Z

🤖 DevSecOps daily sweep (TIM-430, 2026-10-15).

CI gate failure — not auto-merging. Lint, Test, Build & Security check is FAILURE; other checks (cflite-pr, CodeQL-Build, dependency-review, Detect changes, CodeQL, codecov, CodeRabbit, renovate/stability-days) green.

Skipping until the Lint/Test/Build pipeline is green. Multi-major bump (minimatch@3>brace-expansion 1 → 5) needs human approval per the autopilot's risk-tier rules. The diff also rewrites pnpm-workspace.yaml alongside the lockfile — that goes beyond a lockfile-only change, so it can't be auto-merged regardless of CI state.

timoa · 2026-10-16T00:02:12Z

Renovate daily sweep (TIM-432) — skipping this PR. CI gate not green:

Lint, Test, Build & Security — FAILURE
cflite-pr, CodeQL-Build, dependency-review, Detect changes, CodeQL — SUCCESS
codecov/patch, codecov/project — SUCCESS
cflite-batch — SKIPPED

Diff: pnpm-lock.yaml + pnpm-workspace.yaml (no hard-exclusion paths). Lockfile + workspace bump of minimatch@3>brace-expansion 1.1.16 → 5.0.12 (transitive major). Lint fails.

This PR cannot be auto-merge while Lint, Test, Build & Security is red. @dev please verify the lint pipeline against brace-expansion v5 on the older minimatch@3 line.

timoa · 2026-10-18T00:02:03Z

Renovate daily review — CI blocked: Lint, Test, Build & Security is failing. Bump is minimatch@3>brace-expansion 1→5 (MAJOR). Lockfile-only changes. Workflow run: https://github.com/timoa/workflow-metrics/actions?query=branch%3Arenovate%2Fminimatch3-brace-expansion-5.x. Please fix CI or rebase.

timoa · 2026-10-19T00:02:31Z

DevSecOps daily sweep (TIM-445, 2026-10-19): skipped-blocked. Lint, Test, Build & Security is FAILURE (minimatch@3>brace-expansion 1.1.16 → 5.0.12, major). Lockfile + workspace YAML only. Other checks green. No auto-merge attempted.

timoa · 2026-10-20T00:04:52Z

DevSecOps sweep: skipping. Lint, Test, Build & Security is FAILING. Please fix CI before requesting merge.

timoa · 2026-10-21T00:02:19Z

DevSecOps daily sweep: 'Lint, Test, Build & Security' check FAILURE (run 36521951166). Major bump (brace-expansion v1→v5) needs human review. Skipping auto-merge.

timoa · 2026-10-22T00:01:48Z

DevSecOps daily sweep — blocked. Major bump of transitive minimatch@3>brace-expansion from 1.1.16 to 5.0.12 (jumps 4 majors; ESM switch). Lint, Test, Build & Security is failing on this branch. Requires human triage before merging.

timoa · 2026-10-24T00:07:26Z

Renovate sweep 2026-10-24 — CI gate failure, not merged.

Lint, Test, Build & Security fails (osv-scanner: 2 critical tinypool advisories via vitest, plus 3 moderate — the same pre-existing finding that is already red on main).

Separately, this is a major change to a pnpm override: minimatch@3>brace-expansion 1.1.21 -> 5.0.12. minimatch@3 is used by older tooling; forcing brace-expansion v5 across three majors needs a human to confirm the override range still matches.

Not auto-merged.

timoa · 2026-10-25T00:04:39Z

DevSecOps Renovate sweep 2026-10-25 — skipped-blocked.

Lint, Test, Build & Security = FAILURE (osv-scanner tinypool criticals), plus CodeQL-Build and renovate/artifacts FAILURE (stale lockfile).

Major jump — brace-expansion 1.1.21 -> 5.0.12 (4 majors, ESM switch).

Not merged. Full sweep report: TIM-461.

timoa

DevSecOps Renovate sweep 2026-10-26 — flagged, not merged.

Lint, Test, Build & Security is green now — the osv-scanner/tinypool failure that blocked this yesterday is gone. CI is no longer the issue; the override is.

minimatch@3>brace-expansion 1.1.21 -> 5.0.12 forces v5 onto a consumer that cannot take it:

minimatch@3.1.2 declares brace-expansion: ^1.1.7 and calls it as a function — var expand = require('brace-expansion'), then expand(pattern).
brace-expansion@5.0.12 is a different shape: its CJS build exports a named object (expand, EXPANSION_MAX, EXPANSION_MAX_DEPTH, EXPANSION_MAX_LENGTH, EXPANSION_MAX_REWRITES) with __esModule: true and no callable default. require('brace-expansion') therefore returns an object, and every minimatch@3 call raises TypeError: expand is not a function.

Green CI does not clear this — the affected path is not exercised by the test suite.

It is also not a security fix: 1.1.21 is already patched for GHSA-3jxr-9vmj-r5cp (fixed in 1.1.12). This is churn across 4 majors of a deliberately pinned transitive dep.

Recommendation: close this PR, or keep the minimatch@3>brace-expansion override on the patched 1.x line. Needs a human decision either way.

Full sweep report: TIM-464.

timoa · 2026-10-28T01:06:45Z

DevSecOps Renovate sweep 2026-10-28 — suspicious, NOT merged.

CI is fully green on this head now (the osv-scanner/tinypool blocker from the 2026-10-25 sweep is gone), but green CI is misleading here — this PR breaks minimatch@3 at runtime and the test suite cannot see it.

What the PR does: pins minimatch@3>brace-expansion from 1.1.21 to 5.0.12.

Verified against the published packages:

brace-expansion@5.0.12 CJS build (dist/commonjs/index.js):
Object.defineProperty(exports, "__esModule", { value: true }); exports.expand = expand;
so require('brace-expansion') returns an object, not a callable function.
minimatch@3.1.5 (minimatch.js):
var expand = require('brace-expansion') ... return expand(pattern)
-> TypeError: expand is not a function.

It stays latent only because minimatch@3 short-circuits before that call:

if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) { return pattern }

expand() is reached only for glob patterns that contain braces. Our suite uses no brace globs, so CI stays green. Any brace pattern at runtime — e.g. minimatch('src/**/*.{ts,tsx}') — throws.

Recommendation: do not merge. Keep minimatch@3>brace-expansion at 1.1.21 (v1 is what minimatch@3 declares: ^1.1.7), or bump minimatch itself instead of forcing brace-expansion v5 underneath it. Full sweep report: TIM-470.

timoa

DevSecOps Renovate sweep 2026-11-04 — suspicious, do not merge. Superseded by #99.

This PR forces brace-expansion@5.0.12 onto minimatch@3. minimatch@3.1.2 does var expand = require('brace-expansion') then expand(pattern). brace-expansion@5 sets __esModule: true and exports only named bindings (expand, EXPANSION_MAX_*) — there is no callable default, so any brace pattern raises TypeError: expand is not a function. CI is green only because the test suite never exercises the brace-pattern path, so this breakage would ship silently.

Recommended action: close this PR. It is superseded by #99 (open, CI fully green), which pins minimatch to 11.0.4. That removes minimatch@3 from the tree entirely and makes the minimatch@3>brace-expansion override inert. Once #99 merges, this PR has nothing left to do.

Not a security fix: brace-expansion@1.1.21 already carries the EXPANSION_MAX_LENGTH / EXPANSION_MAX_DEPTH / EXPANSION_MAX_REWRITES hardening, and OSV lists no advisory against 1.1.21 or 5.0.12.

timoa

DevSecOps Renovate sweep 2026-11-05 — suspicious, do not merge. Refinement of my 2026-11-04 note: the break is latent, not immediate.

Head 0fab97e, unchanged, CI green. This PR rewrites the minimatch@3>brace-expansion override 1.1.21 → 5.0.12, so the lockfile puts brace-expansion@5.0.12 under minimatch@3.1.5 (dropping balanced-match@1.0.2 and concat-map@0.0.1).

The mechanism, reproduced locally against the published tarballs:

minimatch@3.1.5 does var expand = require('brace-expansion') then return expand(pattern) — a bare call.
brace-expansion@5.0.12 CJS is exports.expand + __esModule: true, not callable.
new Minimatch("**/*.{js,ts}") → TypeError: expand is not a function.

Refinement — why CI is green. minimatch@3 short-circuits unless the pattern contains braces (if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) return [pattern]). No active ESLint config in this repo contains a brace glob today — checked eslint.config.js, the typescript-eslint flat configs and the eslint-plugin-svelte configs; all use plain **/*.ts-style globs. @eslint/config-array's MINIMATCH_OPTIONS is { dot: true, allowWindowsEscape: true } with no nobrace, so the moment a brace glob appears in a files/ignores entry, ESLint throws at config-array level.

So this is not a break that ships today. It is a landmine that arms itself on the first brace glob — and minimatch@3 sits under @eslint/config-array and @eslint/eslintrc, i.e. under ESLint itself.

Recommendation: close this PR. It is superseded by #99 (open, CI fully green), which pins minimatch to 11.0.4 and removes the brace-expansion override problem entirely.

Human approval needed. Full sweep report: TIM-480.

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch 8 times, most recently from 1e40625 to 0083b56 Compare August 6, 2026 16:35

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch from 0083b56 to 2ef69b1 Compare August 13, 2026 13:13

timoa mentioned this pull request Aug 16, 2026

chore(deps): update dependency minimatch@9>brace-expansion to v5 #77

Open

1 task

timoa reviewed Aug 18, 2026

View reviewed changes

timoa reviewed Aug 21, 2026

View reviewed changes

timoa reviewed Aug 24, 2026

View reviewed changes

timoa reviewed Aug 26, 2026

View reviewed changes

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch from 2ef69b1 to 56d4e5e Compare August 26, 2026 13:46

timoa mentioned this pull request Aug 30, 2026

fix(deps): update dependency @ai-sdk/mistral to v3.0.70 #87

Merged

1 task

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch from 382670b to f829d07 Compare October 23, 2026 13:09

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch 7 times, most recently from 1e31d9c to 4a93cd7 Compare October 24, 2026 19:26

timoa mentioned this pull request Oct 25, 2026

chore(deps): update vitest monorepo to v5 #35

Open

1 task

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch 6 times, most recently from 6018ad8 to 3b3684b Compare October 25, 2026 14:58

chore(deps): update dependency minimatch@3>brace-expansion to v5

0fab97e

renovate Bot force-pushed the renovate/minimatch3-brace-expansion-5.x branch from 3b3684b to 0fab97e Compare October 25, 2026 15:00

timoa reviewed Oct 26, 2026

View reviewed changes

timoa reviewed Nov 4, 2026

View reviewed changes

timoa reviewed Nov 5, 2026

View reviewed changes

Conversation

renovate Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

codecov Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

timoa commented Aug 11, 2026

Uh oh!

timoa commented Aug 12, 2026

Uh oh!

timoa commented Aug 13, 2026

Uh oh!

timoa commented Aug 14, 2026

Uh oh!

timoa commented Aug 15, 2026

Uh oh!

timoa commented Aug 16, 2026

Uh oh!

timoa commented Aug 17, 2026

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

timoa commented Aug 19, 2026

Uh oh!

timoa commented Aug 20, 2026

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

timoa commented Aug 22, 2026

Uh oh!

timoa commented Aug 23, 2026

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

timoa commented Aug 29, 2026

Uh oh!

timoa commented Aug 30, 2026

Uh oh!

timoa commented Oct 15, 2026

Uh oh!

timoa commented Oct 16, 2026

Uh oh!

timoa commented Oct 18, 2026

Uh oh!

timoa commented Oct 19, 2026

Uh oh!

timoa commented Oct 20, 2026

Uh oh!

timoa commented Oct 21, 2026

Uh oh!

timoa commented Oct 22, 2026

Uh oh!

timoa commented Oct 24, 2026

Uh oh!

timoa commented Oct 25, 2026

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

timoa commented Oct 28, 2026

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

timoa left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

renovate Bot commented Aug 6, 2026 •

edited

Loading

codecov Bot commented Aug 6, 2026 •

edited

Loading