🏥 CI FailureDependency Vulnerability Audit fails: high-severity minimatch ReDoS in main package

[github-actions]

Summary

The "Audit Main Package" job in the Dependency Vulnerability Audit workflow failed on commit c15f7ec9590641921f34229d4afbe4db534b537a.

This is a recurrence of the same issue previously tracked in #1074 (closed as "not_planned").

Failed Step

Step 8: Run npm audit (fail on high/critical)

npm audit --audit-level=high

Vulnerabilities Found

🔴 High Severity — minimatch (10.0.0 - 10.2.2)

Two ReDoS vulnerabilities:

• GHSA-7r86-cg39-jmmj: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
• GHSA-23c5-xmqv-rm74: Nested *() extglobs generate catastrophically backtracking regular expressions

Fix available via npm audit fix.

🟡 Moderate Severity — ajv (<6.14.0 || >=7.0.0-alpha.0 <8.18.0)

• GHSA-2g4f-4pwh-qvx6: ReDoS when using $data option
• Found in: node_modules/@commitlint/config-validator/node_modules/ajv, node_modules/ajv

Note: ajv is moderate severity and does not cause the audit to fail (threshold is high/critical), but is worth tracking.

Root Cause

The minimatch package in the main package's dependency tree has been updated to a version range (10.0.0–10.2.2) that contains two high-severity ReDoS vulnerabilities. The audit enforces --audit-level=high, so the job exits with code 1.

The recent commit c15f7ec fixed the rollup vulnerability in docs-site, but the main package minimatch issue remains unresolved.

Recommended Actions

1. Run npm audit fix in the root package to update minimatch to a patched version
2. Verify the fix doesn't introduce breaking changes
3. Commit the updated package-lock.json

cd /path/to/gh-aw-firewall
npm audit fix
npm test  # verify nothing broken
git add package-lock.json
git commit -m "fix(deps): resolve high-severity minimatch ReDoS vulnerability"

---

🏥 Automatically investigated by CI Doctor

Generated by CI Doctor

[github-actions]

🔄 Failure Recurrence — 2026-03-02

The same vulnerability audit failure has recurred in run 22556425583 on commit c15f7ec.

Failing Job: Audit Main Package

Step: Run npm audit (fail on high/critical)

Vulnerabilities Detected

Package	Severity	Advisory
minimatch (10.0.0 - 10.2.2)	High	GHSA-7r86-cg39-jmmj — matchOne() ReDoS via multiple non-adjacent GLOBSTAR segments
minimatch (10.0.0 - 10.2.2)	High	GHSA-23c5-xmqv-rm74 — nested *() extglobs ReDoS
ajv (<6.14.0 or >=7.0.0-alpha.0 <8.18.0)	Moderate	GHSA-2g4f-4pwh-qvx6 — ReDoS with $data option

Total: 2 vulnerabilities (1 moderate, 1 high)

Recommended Action

npm audit fix

This issue remains unresolved since the first report. The minimatch high-severity vulnerability is still causing CI to fail on every scheduled run.

Generated by CI Doctor

[Mossaka]

Closing: automated CI issue spam cleanup. See root cause analysis below.