vulnerable glob dependency #3246

Activity

1. cclauss

   assigned

   Copilot

   on Nov 19, 2025
2. keptt commented on Nov 19, 2025

   

   keptt

   on Nov 19, 2025

   Last edited by keptt

   More actions

   Hi @JeffreyStevens, I have noticed that my security scan only raised the glob issue related to npm/cli and not to npm/cli's node-gyp dependency. I did some digging and discovered that node-gyp switched to tinyglobby lib with this commit c3b3ab0 (dated Feb 19, 2025). This change went into the 11.2.0 version of node-gyp. The current npm release ships node-gyp 12.1.0, which is healthy as it doesn't rely on glob anymore.
   If I am not mistaken the stock nodejs ships with an older version of npm (something around 10.x.x ), which subsequently uses an older vulnerable version of glob. Try updating your npm after your node installation step. This should fix your issue: npm update -g npm
   Then we will only have to worry about npm updating the vulnerable glob dependency that it still uses directly.
3. cclauss

   added

   wrong repo

   on Nov 19, 2025
4. cclauss commented on Nov 19, 2025

   

   cclauss

   on Nov 19, 2025

   Contributor

   More actions

   Closing because this issue needs to be fix in the npm codebase.
5. cclauss

   closed this as completedon Nov 19, 2025