[Robdel12]

Why

The published Storybook and static-site plugins depend on serve-handler, which pins vulnerable minimatch 3.1.5. The lockfile also retains affected glob and follow-redirects versions through build tooling. Dependabot's recorded update error says it cannot resolve follow-redirects past 1.16.1, while the fix starts at 1.16.2.

Approach

Replace serve-handler with serve-static in both plugins and Vitest's development-only browser test server. This removes that minimatch dependency from the SDKs. Keep explicit HTML and asset URLs, directory indexes, HEAD requests, caching, ranges, and HTTP errors covered through real HTTP requests.

Resolve affected transitive glob versions to 14.0.2 and follow-redirects versions to 1.16.2 with targeted overrides. The existing release-age policy stays in place; no advisory is ignored or dismissed.

Evidence

The production-only workspace audit reports zero vulnerabilities. Packed archives confirm the Storybook and static-site dependencies changed, the Ember SDK depends only on playwright-core, and none of the four SDKs includes its example or test app.

All 1,910 core tests pass with six skips, all 450 JavaScript SDK tests pass, and all 38 Storybook, static-site, and Vitest browser workflow tests pass. The HTTP contracts cover assets, encoded filenames, conditional and range requests, traversal rejection, missing files, methods, and shutdown. Builds, architecture, peer compatibility, lint, formatting, and type checks pass.

Remaining Ember test-app advisory

The full development audit still reports minimatch 3, 5, and 10 exclusively through clients/ember/test-app. These are fixture dependencies, not dependencies of the published Ember SDK.

The paths run through Embroider shared-internals and Broccoli tools, Ember CLI and Testem, and EJS/Jake/filelist. Current upstream releases still require older minimatch majors. Version 11 changes the callable export, removes makeRe(), and changes parsed matchers, so forcing it globally would break consumers. A complete fixture fix needs those consumers upgraded or migrated, followed by the Ember build and browser tests; it is separate from the now-clean SDK production graph.

[vizzly-testing]

Vizzly - Visual Test Results

CLI Reporter - Waiting for build

No builds received yet for this pull request.

CLI TUI - Approved

5 comparisons, no changes detected.

View build

---

_{rd/fix-transitive-security · ad8e22b9}