UI5 / webcomponents-react / 41466034154

86%

push

github

chore(deps): update dependency glob to v14 [security] (#9136)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [glob](https://redirect.github.com/isaacs/node-glob) | [`13.0.6` →
`14.0.2`](https://renovatebot.com/diffs/npm/glob/13.0.6/14.0.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/glob/14.0.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/glob/13.0.6/14.0.2?slim=true)
|

---

### Glob: AbortSignal cancellation bypass allows post-timeout filesystem
traversal
[CVE-2026-118773](https://nvd.nist.gov/vuln/detail/CVE-2026-118773) /
[GHSA-3g3m-2fjr-6pw4](https://redirect.github.com/advisories/GHSA-3g3m-2fjr-6pw4)

<details>
<summary>More information</summary>

#### Details
##### Summary

In glob 13.0.6, an aborted async walk rejects or emits an error but
continues recursively reading directories in the background.

The root cause is that abort branches in src/walker.ts call cb() without
returning. As a result, callers that rely on signal or
AbortSignal.timeout() to bound glob traversal cost can still incur
filesystem I/O and CPU work after the request has already been rejected.

##### Details

This was reproduced on glob v13.0.6 (commit
e80cb38ae).

The README documents that the signal option cancels the glob walk.
However, in src/walker.ts, the following methods call cb() when
this.signal?.aborted is true but do not return:

- GlobUtil.walkCB()
- GlobUtil.walkCB2()
- GlobUtil.walkCBSync()
- GlobUtil.walkCB2Sync()

Example vulnerable pattern:

if (this.signal?.aborted) cb()

Because execution continues after cb(), the walker still reaches
processor.processPatterns(), readdirCB(), and recursive walkCB2() calls.

The issue was directly demonstrated against v13.0.6. A source-history
review shows the same missing-return pattern is... (continued)

4151 of 5195 branches covered (79.9%)

Branch coverage included in aggregate %.

7260 of 8110 relevant lines covered (89.52%)

556260.37 hits per line