@speclynx/apidom-reference 2.12.1 → 2.12.2

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [2.12.2](https://github.com/speclynx/apidom/compare/v2.12.1...v2.12.2) (2026-02-20)
+
+### Bug Fixes
+
+- **security:** replace vulnerabe minimatch with picomatch ([#102](https://github.com/speclynx/apidom/issues/102)) ([678e593](https://github.com/speclynx/apidom/commit/678e5938fd15b13655bbd9324306ecfc247c73c1))
+
 ## [2.12.1](https://github.com/speclynx/apidom/compare/v2.12.0...v2.12.1) (2026-02-18)
 
 **Note:** Version bump only for package @speclynx/apidom-reference

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@speclynx/apidom-reference",
-  "version": "2.12.1",
+  "version": "2.12.2",
   "description": "Advanced algorithms for semantic ApiDOM manipulations like dereferencing or resolution.",
   "publishConfig": {
     "access": "public",
@@ -231,37 +231,38 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@babel/runtime-corejs3": "^7.28.4",
-    "@speclynx/apidom-core": "2.12.1",
-    "@speclynx/apidom-datamodel": "2.12.1",
-    "@speclynx/apidom-error": "2.12.1",
-    "@speclynx/apidom-json-pointer": "2.12.1",
-    "@speclynx/apidom-ns-arazzo-1": "2.12.1",
-    "@speclynx/apidom-ns-asyncapi-2": "2.12.1",
-    "@speclynx/apidom-ns-json-schema-2020-12": "2.12.1",
-    "@speclynx/apidom-ns-openapi-2": "2.12.1",
-    "@speclynx/apidom-ns-openapi-3-0": "2.12.1",
-    "@speclynx/apidom-ns-openapi-3-1": "2.12.1",
-    "@speclynx/apidom-parser-adapter-arazzo-json-1": "2.12.1",
-    "@speclynx/apidom-parser-adapter-arazzo-yaml-1": "2.12.1",
-    "@speclynx/apidom-parser-adapter-asyncapi-json-2": "2.12.1",
-    "@speclynx/apidom-parser-adapter-asyncapi-yaml-2": "2.12.1",
-    "@speclynx/apidom-parser-adapter-json": "2.12.1",
-    "@speclynx/apidom-parser-adapter-openapi-json-2": "2.12.1",
-    "@speclynx/apidom-parser-adapter-openapi-json-3-0": "2.12.1",
-    "@speclynx/apidom-parser-adapter-openapi-json-3-1": "2.12.1",
-    "@speclynx/apidom-parser-adapter-openapi-yaml-2": "2.12.1",
-    "@speclynx/apidom-parser-adapter-openapi-yaml-3-0": "2.12.1",
-    "@speclynx/apidom-parser-adapter-openapi-yaml-3-1": "2.12.1",
-    "@speclynx/apidom-parser-adapter-yaml-1-2": "2.12.1",
-    "@speclynx/apidom-traverse": "2.12.1",
+    "@speclynx/apidom-core": "2.12.2",
+    "@speclynx/apidom-datamodel": "2.12.2",
+    "@speclynx/apidom-error": "2.12.2",
+    "@speclynx/apidom-json-pointer": "2.12.2",
+    "@speclynx/apidom-ns-arazzo-1": "2.12.2",
+    "@speclynx/apidom-ns-asyncapi-2": "2.12.2",
+    "@speclynx/apidom-ns-json-schema-2020-12": "2.12.2",
+    "@speclynx/apidom-ns-openapi-2": "2.12.2",
+    "@speclynx/apidom-ns-openapi-3-0": "2.12.2",
+    "@speclynx/apidom-ns-openapi-3-1": "2.12.2",
+    "@speclynx/apidom-parser-adapter-arazzo-json-1": "2.12.2",
+    "@speclynx/apidom-parser-adapter-arazzo-yaml-1": "2.12.2",
+    "@speclynx/apidom-parser-adapter-asyncapi-json-2": "2.12.2",
+    "@speclynx/apidom-parser-adapter-asyncapi-yaml-2": "2.12.2",
+    "@speclynx/apidom-parser-adapter-json": "2.12.2",
+    "@speclynx/apidom-parser-adapter-openapi-json-2": "2.12.2",
+    "@speclynx/apidom-parser-adapter-openapi-json-3-0": "2.12.2",
+    "@speclynx/apidom-parser-adapter-openapi-json-3-1": "2.12.2",
+    "@speclynx/apidom-parser-adapter-openapi-yaml-2": "2.12.2",
+    "@speclynx/apidom-parser-adapter-openapi-yaml-3-0": "2.12.2",
+    "@speclynx/apidom-parser-adapter-openapi-yaml-3-1": "2.12.2",
+    "@speclynx/apidom-parser-adapter-yaml-1-2": "2.12.2",
+    "@speclynx/apidom-traverse": "2.12.2",
     "@swaggerexpert/arazzo-runtime-expression": "^2.0.3",
     "axios": "^1.13.0",
-    "minimatch": "^7.4.6",
+    "picomatch": "^4.0.3",
     "process": "^0.11.10",
     "ramda": "~0.32.0",
     "ramda-adjunct": "^6.0.0"
   },
   "devDependencies": {
+    "@types/picomatch": "^4.0.2",
     "axios-mock-adapter": "^2.0.0"
   },
   "files": [
@@ -274,5 +275,5 @@
     "README.md",
     "CHANGELOG.md"
   ],
-  "gitHead": "3cb0ffe38758d0d432f99272f2118291bdd7b717"
+  "gitHead": "7bc11a08265800191d7c0026526afc71c35d3e99"
 }

package/src/resolve/resolvers/file/index-node.cjs

@@ -6,7 +6,7 @@ exports.__esModule = true;
 exports.default = void 0;
 var _nodeFs = require("node:fs");
 var _nodeUtil = require("node:util");
-var _minimatch = _interopRequireDefault(require("minimatch"));
+var _picomatch = _interopRequireDefault(require("picomatch"));
 var _Resolver = _interopRequireDefault(require("../Resolver.cjs"));
 var url = _interopRequireWildcard(require("../../../util/url.cjs"));
 var _ResolverError = _interopRequireDefault(require("../../../errors/ResolverError.cjs"));
@@ -30,7 +30,7 @@ class FileResolver extends _Resolver.default {
   }
   canRead(file) {
     return url.isFileSystemPath(file.uri) && this.fileAllowList.some(pattern => {
-      return typeof pattern === 'string' ? (0, _minimatch.default)(file.uri, pattern, {
+      return typeof pattern === 'string' ? _picomatch.default.isMatch(file.uri, pattern, {
         matchBase: true
       }) : pattern.test(file.uri);
     });

package/src/resolve/resolvers/file/index-node.mjs

@@ -1,6 +1,6 @@
 import { readFile } from 'node:fs';
 import { promisify } from 'node:util';
-import minimatch from 'minimatch';
+import picomatch from 'picomatch';
 import Resolver from "../Resolver.mjs";
 import * as url from "../../../util/url.mjs";
 import ResolverError from "../../../errors/ResolverError.mjs";
@@ -23,7 +23,7 @@ class FileResolver extends Resolver {
   }
   canRead(file) {
     return url.isFileSystemPath(file.uri) && this.fileAllowList.some(pattern => {
-      return typeof pattern === 'string' ? minimatch(file.uri, pattern, {
+      return typeof pattern === 'string' ? picomatch.isMatch(file.uri, pattern, {
         matchBase: true
       }) : pattern.test(file.uri);
     });