npm audit: minimatch < 11.0.1 (GHSA-g3hv-75wg-m249) via multimatch@5.0.0: fix needs Node 20 #1468

javascript-obfuscator version: 5.9.1

npm audit flags GHSA-g3hv-75wg-m249 (minimatch, moderate, denial of service via globparts amplification) for every project that installs javascript-obfuscator:

javascript-obfuscator@5.9.1
└─┬ multimatch@5.0.0
  └── minimatch@3.1.5

The only patched version is minimatch@11.0.1. multimatch has a single use, SourceCodeFileUtils.isExcludedPath (the CLI --exclude option), so it could be replaced with a few lines on top of minimatch@11, which still ships a CommonJS build. However minimatch@11.x depends on brace-expansion@^5.0.12, which requires Node 20 || >=22.

For what it's worth, the practical risk is low: the vulnerable code only runs on --exclude patterns, which whoever runs the build supplies. The main benefit is clearing the audit warning for downstream projects.