Skip to content

Dependency Security: js-beautify pulls vulnerable minimatch (ReDoS) #110

Open
Open
Dependency Security: js-beautify pulls vulnerable minimatch (ReDoS)#110
Milestone
in testing

Description

@Razerspine
Razerspine
opened on Feb 25, 2026

Hello! I'm using pug-plugin@6.0.0 in a monorepo. Currently, js-beautify depends on older versions of glob and editorconfig, which in turn pull minimatch < 10. This triggers a ReDoS vulnerability advisory.

To fix this, I have to use manual overrides in package.json to force minimatch@10 and glob@13.

Are there any plans to update the js-beautify dependency or switch to a more secure formatter (like Prettier) to resolve this transitive vulnerability?

Activity

  1. webdiscus commented on Feb 25, 2026

    @webdiscus
    webdiscus
    on Feb 25, 2026
    Owner

    Hallo @Razerspine,

    thanks for the issue. I will update all dependencies to actual versions at WE.

  2. webdiscus
    added this to the analyse milestone on Feb 25, 2026
  3. webdiscus
    modified the milestones: analyse, in devolopment on Mar 9, 2026
  4. webdiscus
    added a commit that references this issue on Mar 9, 2026

    fix: force `minimatch@10` and `glob@13` in transitive dependencies to…

    c3b29df

  5. webdiscus commented on Mar 9, 2026

    @webdiscus
    webdiscus
    on Mar 9, 2026
    Owner

    Hello @Razerspine,

    sorry for delay. The fix is released in v6.1.0.

    I have updated js-beautify to the latest version and added overrides to package.json:

      "overrides": {
    "minimatch": "^10.0.0",
    "glob": "^13.0.0"
  }
  6. webdiscus
    modified the milestones: in devolopment, in testing on Mar 9, 2026

  7. Razerspine commented on Mar 12, 2026

    @Razerspine
    Razerspine
    on Mar 12, 2026
    Author

    Hi @webdiscus ,

    Thank you so much for the quick turnaround and for releasing v6.1.0!

    I really appreciate the fix. To be honest, I was using the exact same overrides workaround in my own package.json to suppress the warnings before this update.

    While this resolves the immediate ReDoS advisory, using overrides feels a bit like a temporary band-aid. The root of the problem is that js-beautify itself hasn't been actively updated in a while and continues to rely on outdated, insecure dependencies out of the box.

    Do you think migrating to a more actively maintained formatter (like Prettier or similar) could be an option for a future major release of the plugin?

    Thanks again for your hard work and for maintaining this awesome plugin!

  8. webdiscus commented on Mar 12, 2026

    @webdiscus
    webdiscus
    on Mar 12, 2026
    Owner

    Hi @Razerspine,

    Thanks for the feedback!
    Currently, I may be very slow to migrate from js-beautify to any other formatter (e.g. Prettier is good alternate) on my own.
    Any PR is very welcome!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions