Build dependency chain installs [email protected] affected by GHSA-mh99-v99m-4gvg #129

Summary

The current Shopify Function JavaScript toolchain installs
[email protected] through [email protected]. npm audit reports
GHSA-mh99-v99m-4gvg as high severity.

Environment and versions

• Node.js 24.13.1
• npm 11.8.0
• @shopify/shopify_function 2.0.1
• graphql-config 5.1.3
• minimatch 9.0.9
• brace-expansion 2.1.2

Reproduction

In a Shopify app with a JavaScript Function extension:

1. Run npm ci from a clean checkout.
2. Run npm explain minimatch --json.
3. Run npm explain brace-expansion --json.
4. Run npm audit --json.

The Function workspace reaches the affected package through the Shopify
Function/code-generation build chain, including graphql-config/minimatch.

The production app build was generated with:

npm exec --offline -- shopify app build --config production --no-color --skip-dependencies-installation

We checked the generated Function JavaScript and WASM with static byte/string
searches and found no minimatch, brace-expansion, or graphql-config package
reference. We therefore believe this is a build-tool dependency, but still
fail our dependency audit until it is resolved or narrowly reviewed.

Forcing minimatch 10 as a consumer override is not a safe workaround:
graphql-config 5.1.3 declares minimatch ^9.0.5, so npm reports the dependency
tree as invalid.

Expected result

The supported Function build dependencies should resolve to a minimatch /
brace-expansion combination that is not affected by
GHSA-mh99-v99m-4gvg.

The smallest preferred fix is a compatible Shopify Function dependency update
whose graphql-config/minimatch ranges support a patched brace-expansion
release, without requiring consumers to force an out-of-range major override.

Additional context

The package is used by the build toolchain and is not imported by the
generated Function JavaScript or WASM artifact in our verification. We are
still treating the audit result as fail-closed and would prefer an upstream
dependency update over an incompatible package override.