[ecv]

Dependabot cannot fix minimatch GHSA-g3hv-75wg-m249 (medium, a crafted glob pattern can stall the process) in this repo, because the fix exists only in minimatch 11.0.1+ and every parent asks for ^10 or older. This PR is a partial fix: it moves the minimatch 10 and glob 13 copies to the fixed versions and deliberately leaves the minimatch 3 copies behind.

What changes

• package.json overrides gain "minimatch@^10": "11.0.4" and "glob@^13": "14.0.3"; package-lock.json is regenerated with npm install --package-lock-only --ignore-scripts.
• glob moves too. glob 13 bundles its own copy of minimatch 10, so forcing minimatch alone would clear the alert but leave the vulnerable code running inside glob. glob 14 bundles minimatch 11.
• Lock before: minimatch 3.1.5 (five copies) and 10.2.5, glob 7.2.3 and 13.0.6. After: minimatch 3.1.5 (same five copies) and 11.0.4, glob 7.2.3 and 14.0.3.

What stays vulnerable, and why that is acceptable

• minimatch 3.1.5 remains under eslint, @eslint/eslintrc, @eslint/config-array, fork-ts-checker-webpack-plugin and broadcast-channel. The broadcast-channel copy comes with glob 7.2.3 via rimraf 3, pulled in by react-query (through @strapi/plugin-users-permissions).
• A blanket override cannot cover it: rimraf 3 calls glob's callback form, which glob 14 no longer has, and glob 7 itself needs the minimatch 3 API.
• The real risk is near nil. The stall needs an attacker-supplied glob pattern; here the patterns are fixed config values in lint and build tooling and an unused cache-cleanup path.
• What removes it: a react-query that no longer depends on broadcast-channel, and ESLint tooling moving off minimatch 3.
• Any Dependabot alert for this advisory stays open for the minimatch 3 copies; this PR is Related to it, not a fix.

Evidence

• Lock check: no minimatch 10.x and no glob 13.x remain; glob 7.2.3 and minimatch 3.1.5 are still where they were.
• minimatch 11 removes makeRe, regexp, AST and matchOne. The moved copies are used by @strapi/cloud-cli (minimatch()), @strapi/core (glob.glob()) and rimraf 6 (glob 14), all of which stay compatible. One exception: typedoc, a dependency of @strapi/types, calls matchOne in its file walker. Nothing in @strapi/* dist or this repo invokes typedoc; it only runs from @strapi/types' own doc:ts script.
• npm run lint (0 errors, 2 existing warnings) and npm run build (strapi build) pass on the new lock. The repo has no test script.
• minimatch 11.0.4 (2 Nov) and glob 14.0.3 (28 Oct) were published more than 7 days ago or fix a published advisory (advisory published 30 Oct 2026).