[GioDavid]

Summary

Removes the vulnerable minimatch@10.1.2 from the dependency tree by upgrading eslint-plugin-sonarjs from ^3.0.3 to ^4.0.3.

eslint-plugin-sonarjs@3.0.7 pins minimatch to exactly 10.1.2, which is affected by three high-severity ReDoS advisories:

Advisory	CVE	Affected	Fixed
GHSA-3ppc-4f35-3m26	CVE-2026-26996	>=10.0.0 <10.2.1	10.2.1
GHSA-7r86-cg39-jmmj	CVE-2026-27903	>=10.0.0 <10.2.3	10.2.3
GHSA-23c5-xmqv-rm74	CVE-2026-27904	>=10.0.0 <10.2.3	10.2.3

No 3.x release of the plugin fixes this (3.0.7 is the last one). 4.0.3 depends on minimatch@^10.2.5 and reuses the 10.2.5 entry that's already in the lockfile. The plugin is a root devDependency used only by yarn lint, so the published package isn't affected.

Changes

• package.json: eslint-plugin-sonarjs ^3.0.3 → ^4.0.3
• yarn.lock: the lockfile pins 4.0.3 rather than the latest 4.2.x, to keep the change small. It removes minimatch@10.1.2, @isaacs/brace-expansion, @isaacs/balanced-match and a duplicate semver, and adds globals@17.13.0 (used by the plugin). TypeScript resolutions are unchanged.

Compatibility

• 3.0.7 and 4.0.3 have the same rule count (269) and the same CJS entry point. enforce-trailing-comma and super-invocation were removed; this config uses neither. Two new rules, dompurify-unsafe-config and no-session-cookies-on-static-assets, are added to recommended. They report nothing on the current code.
• Lint output is identical to main. A deliberate violation test confirmed the plugin is active (sonarjs/no-all-duplicated-branches fired).
• The plugin calls minimatch in the same way in both versions. On those call patterns, 10.1.2 and 10.2.5 matched identically in 264 cases.

Test plan

Run locally on Node 20, 22, 24 (the CI versions) and 26:

• yarn install --immutable
• yarn compile
• yarn lint (output identical to main)
• yarn build
• yarn test:ci: 22/22 passed
• yarn why minimatch: versions 10.2.5, 10.2.6, 8.0.7 and 3.1.5, none of them affected
• yarn npm audit --all --recursive: minimatch findings 3 → 0, nothing new

yarn workspace example web:build fails the same way on main (react-native-svg → codegenNativeComponent resolution), so it's not affected by this change.

The shell-quote resolution update is in a separate PR (fix/security-shell-quote).

🤖 Generated with Claude Code