fix: update minimatch to 3.1.5 to resolve security vulnerabilities

[ParakhJaggi]

Summary

Bumps minimatch from 3.1.2 to 3.1.5 — the latest patch release in the 3.x line. This is a non-breaking, patch-level update that resolves three high-severity ReDoS vulnerabilities:

• GHSA-3ppc-4f35-3m26 — ReDoS via repeated wildcards with non-matching literal in pattern
• GHSA-7r86-cg39-jmmj — ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
• GHSA-23c5-xmqv-rm74 — ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

This causes downstream Dependabot alerts for all consumers of serve-handler (including serve).

Fixes #206

[MikeMcC399]

This would be an alternative to #226

[ParakhJaggi]

This would be an alternative to #226

This is a better alternative imo, v10.2.4 is an aggressive update. 3.1.5 is within the 3.x family and contains the remediation.

[MikeMcC399]

@ParakhJaggi

This would be an alternative to #226

This is a better alternative imo, v10.2.4 is an aggressive update. 3.1.5 is within the 3.x family and contains the remediation.

Note the comment in actions/toolkit#2306 from the package owner, where he talks about updating to v10 to move to a supported version.

The repo maintainers will need to decide which way to go. Your PR would solve the immediate problem.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	minimatch@​3.1.5

View full report

[AndyBitz]

Thanks for opening the PR and reaching out to me!

I'll merge and publish this one instead of the upgrade to 10.x to get it out faster, as the upgrade to 10.x would warrant a major release and it's better to keep this security fix smaller.

We can revisit the upgrade to 10.x afterwards.

[MikeMcC399]

@AndyBitz

This has merged into the master branch not the (default) main branch.

[AndyBitz]

@MikeMcC399 indeed, didn't notice. Will get this sorted, thanks!

[AndyBitz]

Published the serve-handler update in 6.1.7, will now take care of serve itself.
Thanks again!