Bump glob to ^14.0.2 in @sentry/bundler-plugins and @sentry/react-router: npm audit flags GHSA-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249 #25969

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/react-router

SDK Version

11.10.0 (also @sentry/vite-plugin 11.10.0 and @sentry/node 11.10.0)

Framework Version

React Router 8.5.1, Vite 8.3.5

Link to Sentry event

N/A (install-time dependency issue)

Reproduction Example/SDK Setup

mkdir repro && cd repro
echo '{"name":"repro","private":true}' > package.json
npm install --package-lock-only --ignore-scripts @sentry/react-router@11.10.0 @sentry/vite-plugin@11.10.0
npm ls glob minimatch --package-lock-only
npm audit --package-lock-only

Node 26.12.0, npm 11.20.0.

Steps to Reproduce

1. Install @sentry/react-router@11.10.0 (or @sentry/vite-plugin@11.10.0, or @sentry/node@11.10.0, which depends on @sentry/bundler-plugins).
2. Run npm audit.

Expected Result

No advisories coming from Sentry's own dependency ranges, given that fixed releases of glob and minimatch exist.

Actual Result

glob resolves to 13.0.6 and minimatch to 10.2.6:

`-- @sentry/react-router@11.10.0
  +-- @sentry/bundler-plugins@11.10.0
  | `-- glob@13.0.6 deduped
  `-- glob@13.0.6
    `-- minimatch@10.2.6

npm audit reports 6 moderate vulnerabilities, all from these two advisories, with "No fix available":

• GHSA-3g3m-2fjr-6pw4 glob 3.0.0 - 14.0.1, "AbortSignal cancellation bypass allows post-timeout filesystem traversal". First patched version: 14.0.2.
• GHSA-g3hv-75wg-m249 minimatch <11.0.1, "potential denial of service via globparts amplification". glob 14 depends on minimatch@^11.0.2.

Both were published on 2026-10-30. @sentry/bundler-plugins@11.10.0 and @sentry/react-router@11.10.0 declare glob@^13.0.6, so no in-range update reaches a fixed version.

Additional Context

I don't believe either advisory is exploitable through Sentry's own calls: the bundler plugins' globFiles and @sentry/react-router's delete-after-upload step pass only absolute, nodir and root, with no signal, and their patterns are fixed rather than user-supplied. The impact is that consumers' npm audit gates fail with no fix available, including every @sentry/node 11 user, since @sentry/node depends on @sentry/bundler-plugins.

Workaround we're using: npm overrides forcing glob ^14.0.3 under @sentry/react-router and @sentry/vite-plugin. On a real Vite production build, the bundler plugins' globFiles, called with the upload's patterns and root, returned the same file list on glob 14.0.3 as on glob 13.0.6. That is a quick check, not a full upload test.

glob 14's changelog lists breaking changes (minimatch 11, walk() returning arrays, isRegExp() renamed to isMatcher(), the debug option removed, and root-anchored ignore patterns now resolving like other patterns). As far as I can see, none of these affect Sentry's call sites. Moving from glob to tinyglobby, as proposed in getsentry/sentry-javascript-bundler-plugins#869, would also resolve this.

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}