filesystem: minimatch ^10.0.1 keeps installs on a version affected by GHSA-g3hv-75wg-m249 #5420

Which server?

filesystem (@modelcontextprotocol/server-filesystem)

Server version

2.1.0 (npm latest); also v2/main at 72ad22c

How did you run the server?

npx (npm package), as a dependency of another package

Transport

stdio

Protocol era

Not applicable (the report is about a dependency range, not protocol behaviour)

MCP client and version

not client-specific

Operating system and runtime

Fedora 44 (x86_64), Node.js v24.22.0, npm 11.19.1

Server configuration

not configuration-specific

Problem

src/filesystem/package.json declares "minimatch": "^10.0.1". Every minimatch 10.x is below 11.0.1, so every install of @modelcontextprotocol/server-filesystem 2.1.0 resolves a minimatch affected by GHSA-g3hv-75wg-m249 (denial of service through glob-part amplification). The fixed versions are 11.0.1 and later, outside the declared range, so neither a fresh install nor npm update can reach one.

npm audit in any project that depends on the server reports the advisory, and a dependent package cannot fix it for its users: npm reads overrides only from the root project.

The server passes search_files patterns and the excludePatterns of search_files and directory_tree to minimatch, so the patterns come from the client.

Steps to reproduce

mkdir repro && cd repro && npm init -y >/dev/null
npm install @modelcontextprotocol/server-filesystem@2.1.0
npm ls minimatch     # minimatch@10.2.6
npm audit            # minimatch <11.0.1, GHSA-g3hv-75wg-m249 (and glob's GHSA-3g3m-2fjr-6pw4, fixed by #5351)

Expected

A release whose minimatch range includes a fixed version.

Proposed change

Raise minimatch in src/filesystem/package.json to ^11.0.3, refresh package-lock.json, and add a patch changeset. The server calls only minimatch(path, pattern, { dot: true }) (lib.ts and server.ts), which minimatch 11 keeps; 11 removes makeRe(), Minimatch#regexp, the AST class and the debug option, none of which the server uses. The lockfile gains @isaacs/nonrecursive-glob-match 1.0.3 (BlueOak-1.0.0), a new dependency of minimatch 11.

glob is not part of this: #5186 / #5351 already removed it on v2/main.

How I verified it

On v2/main at 72ad22c, Node.js v24.22.0, npm 11.19.1:

• Before: npm ci, then npm run validate -w src/filesystem: 25 test files passed, 655 tests passed, 14 skipped. npm ls minimatch -w src/filesystem shows 10.2.5.
• npm install minimatch@^11.0.3 -w src/filesystem. npm ls now shows 11.0.3.
• After: npm run validate -w src/filesystem (format check, lint, typecheck, build, tests): 25 test files passed, 655 tests passed, 14 skipped. npm run coverage -w src/filesystem passed. npm audit -w src/filesystem: found 0 vulnerabilities.

The steps to reproduce were run on 2026-11-01 in an empty folder (npm install --ignore-scripts): npm ls printed minimatch 10.2.6 and glob 13.0.6, and npm audit reported both advisories.

I did not run the full npm run local:gate.

Prompt used

In modelcontextprotocol/servers on v2/main, update minimatch in src/filesystem to ^11.0.3
to move it out of the range of GHSA-g3hv-75wg-m249. Change only src/filesystem/package.json,
refresh package-lock.json with npm, and add a patch changeset for
@modelcontextprotocol/server-filesystem. Check that the server only calls APIs that
minimatch 11 keeps. Run npm run validate -w src/filesystem before and after the change,
and npm audit -w src/filesystem after it.

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory form).