From 5dd2ed89d00fc6155becf53de5aca80f32b3023e Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Fri, 6 Nov 2026 10:44:57 -0500
Subject: [PATCH] chore: Force minimatch 11 for GHSA-g3hv-75wg-m249

A crafted glob pattern can stall the process (medium). The fix exists
only in minimatch 11.0.1+, and every parent asks for ^10 or older, so
Dependabot cannot open a fix.

Pin minimatch ^10 to 11.0.4 and glob ^13 to 14.0.3 with version-scoped
overrides. glob 13 bundles its own minimatch 10 copy, so forcing
minimatch alone would leave the vulnerable code running inside glob;
glob 14 bundles minimatch 11.

This is partial. The glob 7 and minimatch 3.1.5 copies stay: glob 7
callers (rimraf 3, jest 29, test-exclude 6) use the callback and
promisify API that glob 14 dropped, so a blanket override would break
them.
---
 package-lock.json | 33 ++++++++++++++++++++-------------
 package.json      |  4 +++-
 2 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e109f85..ff7d000 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2897,6 +2897,12 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz",
+      "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -12563,14 +12569,14 @@
       "license": "MIT"
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
+      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.2",
+        "minimatch": "^11.0.2",
         "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
+        "path-scurry": "^3.0.0"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -16199,15 +16205,16 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.4.tgz",
+      "integrity": "sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.5"
+        "@isaacs/nonrecursive-glob-match": "^1.0.3",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -17133,9 +17140,9 @@
       }
     },
     "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
diff --git a/package.json b/package.json
index 45aac93..3a1f8ab 100644
--- a/package.json
+++ b/package.json
@@ -63,6 +63,8 @@
     "nodemailer": "10.1.4",
     "vite": "^6.4.4",
     "webpack-dev-middleware": "7.4.6",
-    "zod": "$zod"
+    "zod": "$zod",
+    "minimatch@^10": "11.0.4",
+    "glob@^13": "14.0.3"
   }
 }