Chore summary
Ensure the minimatch vulnerability fix in @stoplight/spectral-core is actually released to npm. Although the dependency was updated in the repo, the latest published version (1.21.0) still depends on the vulnerable minimatch@3.1.2.
Tasks
Additional context
As a result, consumers of @stoplight/spectral-core who rely on the published package (currently 1.21.0) still receive the vulnerable minimatch@3.1.2, despite the fix being present on develop.
Chore summary
Ensure the minimatch vulnerability fix in
@stoplight/spectral-coreis actually released to npm. Although the dependency was updated in the repo, the latest published version (1.21.0) still depends on the vulnerableminimatch@3.1.2.Tasks
@stoplight/spectral-corethat depends onminimatch@^3.1.4or later (as already merged inpackages/core).Additional context
developon Mar 10, 2026, updatingminimatchto 3.1.4 as a direct production dependency.As a result, consumers of
@stoplight/spectral-corewho rely on the published package (currently1.21.0) still receive the vulnerableminimatch@3.1.2, despite the fix being present ondevelop.