[From nobody Mon Apr 6 11:07:07 2026 Received: (at 1128579-close) by bugs.debian.org; 6 Apr 2026 10:06:02 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,HAS_BUG_NUMBER, MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_NONE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 92; hammy, 150; neutral, 186; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:46216) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1w9gqI-0009UT-2m for 1128579-close@bugs.debian.org; Mon, 06 Apr 2026 10:06:02 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1w9gqG-00D9OA-2P for 1128579-close@bugs.debian.org; Mon, 06 Apr 2026 10:06:00 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=V+p8qRk7L3NOkmcDVVYF67A/BWnErtx7pac/dK67veQ=; b=PxoTX65EbOGIrrtFSmTrwAqJo5 jWZSj1rRu1359MPKRX6EXjNLGjrQx64rYVIi9R1ZAIuPrmfnezBiHT0lkiacxj+V2fjlgrrQI7t4u JCpqWrXNAGsWl9iBx3vXtv8914dhx3oHmG2tApcdRo/qDYArCVunv527KZydvVE9RoZBMr61HkkJg b2iK5YGPK1nPbjtZIvmpekWnbyniHiHdt9OpeTPThm1z3NuCYxG9Q7D7bLhIZ9DdKCMfxUhIrm8t9 qQF8WhECaktmcRhzLZMpbywrYg65FwYW3vQG3PGUJcbPTsUNq49waILOFPwINnxxgCZtGuNgJIg5f K2Tg/FAA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1w9gqF-0000000HS4V-2T9w; Mon, 06 Apr 2026 10:05:59 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Xavier Guimard <yadd@debian.org> To: 1128579-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: node-minimatch Debian: DAK Debian-Changes: node-minimatch_9.0.7-1_sourceonly.changes Debian-Source: node-minimatch Debian-Version: 9.0.7-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1128579: fixed in node-minimatch 9.0.7-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============5745194883660852667==" Message-Id: <E1w9gqF-0000000HS4V-2T9w@fasolo.debian.org> Date: Mon, 06 Apr 2026 10:05:59 +0000 X-CrossAssassin-Score: 2 --===============5745194883660852667== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: node-minimatch Source-Version: 9.0.7-1 Done: Xavier Guimard <yadd@debian.org> We believe that the bug you reported is fixed in the latest version of node-minimatch, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1128579@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Xavier Guimard <yadd@debian.org> (supplier of updated node-minimatch package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 06 Apr 2026 11:41:05 +0200 Source: node-minimatch Architecture: source Version: 9.0.7-1 Distribution: unstable Urgency: medium Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.= debian.org> Changed-By: Xavier Guimard <yadd@debian.org> Closes: 1128579 1129095 Changes: node-minimatch (9.0.7-1) unstable; urgency=3Dmedium . * Team upload * New upstream version 9.0.7 (Closes: #1128579, #1129095) - fixes CVE-2026-26996, CVE-2026-27903, CVE-2026-27904 (ReDoS) * Declare compliance with policy 4.7.4 * debian/watch version 5, optimize * Switch build from rollup to tshy * Add patch to use brace-expansion 2.x default export * Use index.cjs wrapper for backward-compatible default export * Drop unused build-deps: rollup plugins, ts-node, node-tap * Replace upstream ESM tests with minimal require test (upstream tests need tap >=3D 21, not available in Debian) Checksums-Sha1:=20 ad396f73efbbe57234c48e07b73db07962d04abd 2081 node-minimatch_9.0.7-1.dsc 670520f954d0f4532cb66e23ed8b9ccb79c420ea 103051 node-minimatch_9.0.7.orig.ta= r.gz 95ac5483176563b9af9ad931bd496a08f56a111f 4840 node-minimatch_9.0.7-1.debian.= tar.xz Checksums-Sha256:=20 b5e7e5b95a956cf02dc9e4a02711befac763e03f9b798b7027c83f174d2a48ef 2081 node-m= inimatch_9.0.7-1.dsc 8ce497d77411b0b1c3a1b02fc10db086a9e2699ab9447679fbd1843df378be72 103051 node= -minimatch_9.0.7.orig.tar.gz 65264945986cb7f4fca96225adf3ad0853cd148eaca4c09be6d55f4b7dce64d9 4840 node-m= inimatch_9.0.7-1.debian.tar.xz Files:=20 0d5904b2bee4b4f8261ad344b7020b0a 2081 javascript optional node-minimatch_9.0= .7-1.dsc 8ce743300cf8adda6106fe6364f37882 103051 javascript optional node-minimatch_9= .0.7.orig.tar.gz 531596a1be15e850568d8565d006bb9c 4840 javascript optional node-minimatch_9.0= .7-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmnTgEcACgkQ9tdMp8mZ 7umKrBAAk0ygdwSI1n/H8gfiwPaCYV26rROUkqQbcf72w0+PFxxw1fj0D6bNrr+o JVLLU2kWX4x8ajuulhV9l09qys5LcwHreDvPOVWDAafNfq/shppGo9SNwykSYE6U UqGfgQsz+UH4EMXwCe0yLIWA+byoEhAExBh9PcWkIC0TofkVZMaWxvlfQC+hMEuI mV94tEQx3sgWBsorgsmBXYmS4ZciQPhoPL0LdOGKzSwGxje4wB3e1Q+XNVkiloAo 0Nk+rRMlvQTYQBVH6QR9wKVlAmm8bIGabxYQOc2gyeZl4eLMAuKXT1eAMvdP6TWz 8W6xlz5zrVZp4eNFb7REf7wtBj2/2INbLB31wl0Fhlstayzp3d8dyl1nKDMFh05q K5+MdbUYuTPkTj7l3dPpmvjRHpoZLu1x0dC8XNz2iKXStKP8bUvZEE8Q9Btt5Rs/ iUN04EeFhz8u5rC+i4n50SFHWMFMB8m3M9HyL2UzAQoJFZ9t63WR0yA5Ggcw/HDI G1A/hB9hTkhlSKU2YrmBu+eATH/19FkSe1jlQ3wCDIyyc/ZgGTiQcea7fIhm/Dii ivj8MFWJBShVHBouYcy2JpLIqNgiwMotxwD/ijtJdN6R9ni1c0FHCGiwI4xV5ES3 FQm4hbliazD11GsQcfmuz1hC+eI+/RcwaWeE3muz/r57z9+Gffw=3D =3DMxAh -----END PGP SIGNATURE----- --===============5745194883660852667== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCadOFhwAKCRCb9qggYcy5 IewFAP9fyK3/0WbWo6MwnQUCNub3b1XO9O/Z0GdOmMcGK2vFsgD6Awzxi3YF/uEA OjmVW06IKurhI3DKAcEIJk1Uljafsgs= =E2Px -----END PGP SIGNATURE----- --===============5745194883660852667==-- ]