Loading today’s stories
Security1 distinct publisher3 min readPublished
A TypeScript monorepo accumulated eight glob versions, seven of minimatch and three of brace-expansion, and the dozens of GitHub alerts they raised over twelve months were mostly ReDoS the code could not reach.
The Watch · Security desk
security
WSL is a working bridge, and npm hygiene stops at the container wall1 distinct publisher
build
A GitHub graph in 21 requests: what PR metadata already knows about your files1 distinct publisher
build
Yadda 3's real artifact is not the code, it is the rules the agent could not rewrite1 distinct publisher
security
CISA names two poisoned axios releases, and the bill lands on whoever owns the CI secrets1 distinct publisher
Compiled by The WatchSomething wrong?How this is made
An advisory fires the same way no matter where the pattern in your code actually comes from. ReDoS in a path-matching library matters when the pattern arrives from an untrusted request and does not matter when it arrives from a build script, and the alert fires identically in both cases. The judgement in this account is the author's own, about his employer's repository: mostly ReDoS and classes not exploitable in that specific use case, but still enough to spend CI compute on attempted updates and engineer hours on triage [4]. These are the counts of one practitioner working in one private monorepo, and nobody outside can check them. Treat the numbers as a report from a repo rather than ecosystem telemetry.
The arithmetic is what carries. Eight glob versions across five major lines [1], seven minimatch and three brace-expansion arriving underneath them [2], is eighteen distinct copies of three packages in one dependency subtree [1]. An advisory filed against one major line resolves only for the copies sitting on that line, because npm's resolver is built to hold several versions of the same dependency at once [7]. Five major lines of glob means five separate upgrade decisions, each with its own breaking-change review, before the queue clears.
The cadence compounds this. slonik went from v33 to v49 in three years in the same repo [5], which is sixteen major bumps [2], one every ten weeks [3]. The post asks maintainers to slow to one major every two or three years [8]; slonik is running eleven to sixteen times faster than that [4]. The author says the upgrade path from v33 to v49 is not simple [5], and that is the piece that turns a version number into a security backlog: when the jump is expensive, the old copy stays resolved and keeps generating alerts.
The manifest advice is the part with a direct control attached. A library that declares `axios: ^1` lets a downstream resolver pick any 1.x, including a de-duped patched one, without waiting for the library to publish [10]. When Dependabot narrows that to `^1.18.0` to close a single alert, it removes that flexibility from every consumer [10]. Same logic behind declaring `brace-expansion: ^2 || ^3 || ^4`, which the author argues is safe for ESM callers of the basic API because it did not change across those majors [11].
Counterexamples exist and they are load-bearing packages. debug's 4.x line has been active since 2018, about eight years as of the post [12][5]. semver has been on 7.x since 2019, about seven [12][6]. strip-ansi has had only 6.x and 7.x active since 2019, and axios has stayed on 1.x since 2022 [12]. About 47 percent of npm's most-downloaded packages in August carried no dependencies at all [9], which sets the floor for how much of this fan-out is actually structural.
The second bill goes upstream. Maintainers field requests to widen or bump dependency constraints purely so a downstream alert closes [6], for advisories that were never reachable in the reporting codebase. That is unpaid triage on a finding of no consequence, and it comes out of the same hours a maintainer would use to ship a real fix. semver.org's own FAQ says incompatible changes should not be introduced lightly to software with a lot of dependent code, because the cost of upgrading can be significant [14]. The spec allows a major bump without requiring one.
Ranked by verification strength, evidence, and original report placement.
Between them, these packages generated dozens of GitHub security alerts in the repository over the past 12 months.
The alerts were mostly ReDoS and vulnerability classes that the author says are not exploitable in his organisation's specific use case, but still trigger compute to attempt updates and consume engineer time to triage.
A medium-sized TypeScript monorepo at the author's employer was using eight distinct versions of glob across five major version lines.
glob's transitive dependencies contributed seven distinct versions of minimatch and three distinct versions of brace-expansion to the same repository.
The repository has a single version of slonik, but slonik went from v33 to v49 over three years and the author says the upgrade path between them is not simple.
The post advises libraries to depend on the widest possible version range, for example axios: ^1 rather than letting Dependabot narrow the manifest to axios: ^1.18.0, because the wide range lets library users avoid a vulnerability downstream without a new release of the library.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 1, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One engineer's lockfile, taken on trust
Every number that gives this story its force — eight globs, seven minimatches, dozens of alerts in twelve months — comes from one person reading one private monorepo, with no repository named, no lockfile excerpt and no advisory list a reader could re-count. What can be verified independently is the thinner half: the semver.org FAQ quotation and the release histories of debug, semver, strip-ansi and axios. The 47 percent no-dependency statistic sits in between, printed without a source and without a year attached to 'August'.
Named exemplars, no measured uptake
Adoption of the habit and adoption of the ask are different things, and only the first has evidence. debug holding 4.x since 2018 and semver holding 7.x since 2019 show that slow majors are survivable for popular packages; nothing here shows the practice spreading, and slonik running v33 to v49 in three years is the counterweight sitting in the very same repository. No maintainer has responded to the plea, and no dependency count is reported before and after any change.
Argument outruns its one repo
The gap is modest because nothing is being sold: the payoff of this post is a request to maintainers, not a product launch, and the release-line examples are checkable. It stretches anyway. One monorepo becomes an ecosystem diagnosis, Node's resolver is promoted to original sin without a counterfactual, and the headline remedy — one major every two or three years — comes with no estimate of how many of those dozens of alerts it would have prevented.
The party paying the triage bill
This is written by the person holding the pager, and the argument points where you would expect: work that currently lands on consumers should stay upstream with maintainers. The interest is time, not money — no employer is named, no tool is promoted, no sponsorship appears anywhere. One tension is worth flagging, though: the same alerts are dismissed as unexploitable in the author's own code and counted as harm in the same breath.
Directionally solid, numerically unaudited
On direction, comfortable — the semver.org FAQ quoted in the postfix makes much the same argument in the specification's own voice, and the phenomenon of duplicated transitive versions is familiar to anyone who has read a lockfile. On magnitude, thin. With one publisher carrying the whole story there is no second reading of the version counts, the alert volume, or the premise that brace-expansion's ESM surface held steady across v2 through v4 — the assumption the multi-major range advice stands on.