3 people 79a75645ca fix: bump minimatch to resolve CVE-2026-26996, CVE-2026-27903, CVE-2026-27904 (#6968) ...

## CVE Fix: minimatch

**Package:** `minimatch`
**CVEs:** CVE-2026-26996, CVE-2026-27903, CVE-2026-27904 (all HIGH)
**Vulnerable versions:** `< 3.1.4`, `>= 9.0.0 < 9.0.7`, `>= 10.0.0 <
10.2.3`
**Resolved versions:** `3.1.5`, `9.0.9`, `10.2.4`

### Fix strategy

Lockfile re-resolution (transitive dependency). Removed stale minimatch
resolution entries from yarn.lock files and ran `yarn install` to
re-resolve to the latest compatible versions.

### Files changed

- `libs/cli/js-examples/yarn.lock`
- `libs/cli/js-monorepo-example/yarn.lock`

### Verification

- [x] Lockfile updated — resolved versions are now 3.1.5, 9.0.9, 10.2.4
- [x] All 3 CVEs resolved in both lockfiles

🤖 Submitted by langster-patch

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-27 17:04:40 -08:00

..

checkpoint

release(checkpoint): 0.4.1 (#6966)

2026-02-27 12:55:41 -08:00

checkpoint-conformance

chore(deps-dev): bump the all-dependencies group in /libs/checkpoint-conformance with 2 updates (#6915)

2026-02-23 20:27:22 -08:00

checkpoint-postgres

release(checkpoint): 0.4.1 (#6966)

2026-02-27 12:55:41 -08:00

checkpoint-sqlite

release(checkpoint): 0.4.1 (#6966)

2026-02-27 12:55:41 -08:00

cli

fix: bump minimatch to resolve CVE-2026-26996, CVE-2026-27903, CVE-2026-27904 (#6968)

2026-02-27 17:04:40 -08:00

langgraph

release(langgraph) 1.0.10 (#6967)

2026-02-27 13:00:05 -08:00

prebuilt

release(langgraph) 1.0.10 (#6967)

2026-02-27 13:00:05 -08:00

sdk-js

Revert "docs: add -tunnel flag for node server" (#5397)

2025-07-08 06:49:13 -07:00

sdk-py

release(langgraph) 1.0.10 (#6967)

2026-02-27 13:00:05 -08:00