From 769531d01461d99a0ba7bb78995c54ba51412bc2 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Fri, 6 Nov 2026 10:25:25 -0500
Subject: [PATCH] chore: Force minimatch 11 for GHSA-g3hv-75wg-m249

A crafted glob pattern can stall the process (medium). The fix exists
only in minimatch 11.0.1+, and every parent asks for ^10 or older, so
Dependabot cannot open a fix.

Pin minimatch to 11.0.4 and glob to 14.0.3 in the package manager
overrides. glob 13 bundles its own minimatch 10 copy, so forcing
minimatch alone would leave the vulnerable code running inside glob;
glob 14 bundles minimatch 11.

The lock no longer holds any minimatch below 11 or glob below 14. No
parent in the tree calls the APIs minimatch 11 removes (makeRe, regexp,
AST, matchOne).
---
 ui/consumer/pnpm-lock.yaml      | 34 ++++++++++++++++++++-------------
 ui/consumer/pnpm-workspace.yaml |  2 ++
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/ui/consumer/pnpm-lock.yaml b/ui/consumer/pnpm-lock.yaml
index d600b664..6b1182db 100644
--- a/ui/consumer/pnpm-lock.yaml
+++ b/ui/consumer/pnpm-lock.yaml
@@ -6,6 +6,8 @@ settings:
 
 overrides:
   '@module-federation/dts-plugin>undici': ^7.30.1
+  minimatch: 11.0.4
+  glob: 14.0.3
 
 importers:
 
@@ -563,6 +565,9 @@ packages:
   '@floating-ui/utils@0.2.12':
     resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
 
+  '@isaacs/nonrecursive-glob-match@1.0.3':
+    resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==}
+
   '@jridgewell/gen-mapping@0.3.13':
     resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
 
@@ -1800,8 +1805,8 @@ packages:
     resolution: {integrity: sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==}
     engines: {node: '>=6'}
 
-  glob@13.0.6:
-    resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
+  glob@14.0.3:
+    resolution: {integrity: sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==}
     engines: {node: 18 || 20 || >=22}
 
   html-encoding-sniffer@6.0.0:
@@ -1894,9 +1899,9 @@ packages:
   mdn-data@2.27.1:
     resolution: {integrity: sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==}
 
-  minimatch@10.2.6:
-    resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
-    engines: {node: 18 || 20 || >=22}
+  minimatch@11.0.4:
+    resolution: {integrity: sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==}
+    engines: {node: 20 || >=22}
 
   minipass@7.1.3:
     resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
@@ -1983,8 +1988,8 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
-  path-scurry@2.0.2:
-    resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
+  path-scurry@3.0.0:
+    resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==}
     engines: {node: 18 || 20 || >=22}
 
   picocolors@1.1.1:
@@ -2729,6 +2734,8 @@ snapshots:
 
   '@floating-ui/utils@0.2.12': {}
 
+  '@isaacs/nonrecursive-glob-match@1.0.3': {}
+
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
       '@jridgewell/sourcemap-codec': 1.6.0
@@ -3385,7 +3392,7 @@ snapshots:
       '@sentry/core': 10.78.0
       dotenv: 17.4.2
       find-up: 5.0.0
-      glob: 13.0.6
+      glob: 14.0.3
       magic-string: 0.30.21
     optionalDependencies:
       rollup: 4.62.2
@@ -3869,11 +3876,11 @@ snapshots:
 
   get-nonce@1.0.1: {}
 
-  glob@13.0.6:
+  glob@14.0.3:
     dependencies:
-      minimatch: 10.2.6
+      minimatch: 11.0.4
       minipass: 7.1.3
-      path-scurry: 2.0.2
+      path-scurry: 3.0.0
 
   html-encoding-sniffer@6.0.0:
     dependencies:
@@ -3972,8 +3979,9 @@ snapshots:
 
   mdn-data@2.27.1: {}
 
-  minimatch@10.2.6:
+  minimatch@11.0.4:
     dependencies:
+      '@isaacs/nonrecursive-glob-match': 1.0.3
       brace-expansion: 5.0.12
 
   minipass@7.1.3: {}
@@ -4027,7 +4035,7 @@ snapshots:
 
   path-exists@4.0.0: {}
 
-  path-scurry@2.0.2:
+  path-scurry@3.0.0:
     dependencies:
       lru-cache: 11.5.2
       minipass: 7.1.3
diff --git a/ui/consumer/pnpm-workspace.yaml b/ui/consumer/pnpm-workspace.yaml
index b14ac1ab..cca4eee5 100644
--- a/ui/consumer/pnpm-workspace.yaml
+++ b/ui/consumer/pnpm-workspace.yaml
@@ -29,3 +29,5 @@ allowBuilds:
 
 overrides:
   '@module-federation/dts-plugin>undici': ^7.30.1
+  minimatch: 11.0.4
+  glob: 14.0.3