Repository navigation
Outdated glob dependency #1006
Description
I noticed this old-ish PR: #997
Would it be possible to at least update to version 9 and ideally update to the latest version and fix the test? Right now when we install a package that include commitizen we get the following errors:
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supportedWhen checking what uses inflight:
└─┬ commitizen@4.3.1
└─┬ glob@7.2.3
└── inflight@1.0.6
Activity
IuryAlves commentedon Nov 28, 2025
Even more important now that the glob package has a high vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2025-64756
krishnabrq commentedon Dec 8, 2025
Is this project not being maintained anymore?
hvargas-endpoint commentedon Dec 10, 2025
Are there any updates?
iampitchou commentedon Aug 25, 2026
Hello! Is this issue still planned? Today, the glob version is v13+. The main issue is that the old glob embed a very old version of "minimatch". Thank you very much!
yinzara commentedon Sep 8, 2026
Unfortunately force upgrading this to glob 13+ with "overrides" breaks the package all together with
Cannot read properties of undefined (reading 'sync')build!: drop Node.js 18 support and modernize the dev toolchain
build!: drop Node.js 18 support and modernize the dev toolchain
build!: drop Node.js 18 support and modernize the dev toolchain