UID2-6617: Fix CVE-2026-26996 minimatch ReDoS vulnerability

[sunnywu]

Summary

Fixes UID2-6617

CVE-2026-26996: ReDoS vulnerability in minimatch via repeated wildcards with a non-matching literal.

Approach

Yarn v1's flat node_modules model cannot install two versions of minimatch simultaneously. A global resolutions override forces 10.2.2 for all packages — but eslint-plugin-import 2.x calls minimatch() as a callable default export (pre-v6 API), which breaks under minimatch v10:

TypeError: (0, _minimatch2.default) is not a function

Instead, a scoped Yarn resolution is used to upgrade minimatch only for nodemon (the only production dependency that uses minimatch):

"resolutions": {
  "nodemon/minimatch": "^10.2.1"
}

All other minimatch instances (^3.1.2, ^5.0.1) are in devDependencies only (eslint, jest, eslint-plugin-import, etc.) and revert to their natural 3.1.2 / 5.1.6 versions. These are suppressed in .trivyignore with expiry 2027-02-20 and justification that:

• They are unreachable at runtime in the production application
• They process file-path patterns from config files, not untrusted user input
• Upgrading eslint-plugin-import to support minimatch v10 requires migrating to ESLint v9 (separate effort)

For npm-based repos, nested overrides work correctly; for Yarn v1, the scoped resolution + trivyignore is the correct approach.

Result

Package	Version	CVE status
nodemon (prod)	minimatch 10.2.2	Fixed via scoped resolution
eslint-plugin-import, eslint, jest (devDeps)	minimatch 3.1.2	Suppressed in .trivyignore
jake/filelist (devDeps)	minimatch 5.1.6	Suppressed in .trivyignore

Test plan

• Confirm yarn lint passes without errors
• Confirm Trivy vulnerability scan passes (CVE-2026-26996 suppressed via .trivyignore for dev-only packages)
• Verify yarn.lock shows nodemon/minimatch resolves to 10.2.2
• Confirm app builds and tests pass

🤖 Generated with Claude Code