[nborges-aws]

Description

Address mismatch audit finding that is causing our CI to fail. Fixed by scoping minimatch override to @typescript-eslint/typescript-estree and updating bun.lock to resolve minimatch@11.0.4. This clears the audit finding that failss the linux CI verification job.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran bun test
• I ran the relevant end-to-end tests with bun run test:e2e, or explained why they are not applicable
  (CI does not run them for you)
• I ran bun run typecheck
• I ran bun run lint:check
• I ran bun run format:check
• I ran bun run audit
• I ran bun run secrets:check
• I ran bun run build
• If I modified src/assets/, I updated affected snapshots with bun test <test-file> --update-snapshots and committed them
• If I re-recorded fixtures or golden files, every change beyond account identifiers is explained
  by this PR
• This PR does not change command.md (the release workflow regenerates it)

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-1.0.1.tgz

How to install

gh release download pr-2764-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-1.0.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Verified the change by applying the diff to a clean v1.x checkout and running bun 1.4.4:

• bun install --frozen-lockfile passes, and a plain bun install regenerates a byte-identical bun.lock — the lockfile is reproducible and not hand-edited.
• node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch resolves to 11.0.4; the hoisted minimatch stays at 3.1.5.
• bun audit reports "No vulnerabilities found (checked 800 packages)".

The approach checks out:

• The finding is GHSA-g3hv-75wg-m249 (vulnerable range >=7.0.0 <11.0.1), so 10.2.6 is affected and 11.0.1+ is the only fixed line. ^11.0.1 is the minimal correct bound.
• typescript-estree@8.68.0 declares minimatch: ^10.2.2, so this is a deliberate semver-major override. Its only usage is useProgramFromProjectService.js → minimatch(filePath, pattern, { dot: true }). minimatch 11's breaking changes (removal of makeRe(), Minimatch#regexp, AST, matchOne(), maxExtglobRecursion) don't touch that call, and the CJS minimatch() export still exists in 11.0.4. Even the latest typescript-estree@8.72.1 still declares ^10.2.2, so there's no upstream bump that would fix this — the override is the only route.
• Scoping to @typescript-eslint/typescript-estree instead of a flat "minimatch": "^11.0.1" is the right call: the hoisted minimatch@3.1.5 consumers (eslint, eslint-plugin-import, eslint-plugin-react) rely on the pre-v5 API shape and aren't in the vulnerable range.
• The new @isaacs/nonrecursive-glob-match@1.0.3 lock entry is just minimatch 11's new dependency; nothing else in the lock changed.

Non-blocking note for follow-up, not a change request for this PR: minimatch enters the tree via a runtime dependencies path (@aws/agent-inspector@0.6.2 → eslint-plugin-testing-library → @typescript-eslint/utils → typescript-estree), and overrides in a published package's package.json are ignored by consumers' installers. Users installing @aws/agentcore will still resolve minimatch@10.2.6 — unreachable at runtime, since the CLI ships a bundle and never imports the eslint plugins. The durable fix is upstream in @aws/agent-inspector (eslint plugins shouldn't be in dependencies); that's out of scope here and doesn't affect unblocking CI.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.54%. Comparing base (796277b) to head (5076c6d).
⚠️ Report is 8 commits behind head on v1.x.

Additional details and impacted files

@@           Coverage Diff           @@
##             v1.x    #2764   +/-   ##
=======================================
  Coverage   96.54%   96.54%           
=======================================
  Files         706      706           
  Lines       58543    58543           
=======================================
+ Hits        56521    56522    +1     
+ Misses       2022     2021    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.