[horsefacts]

Bumps glob from 10.5.0 to 14.0.2 under archiver-utils (pulled in by testcontainers -> archiver@7 in localnet), which also moves its minimatch from 9.0.9 to 11.0.4.

• archiver-utils@5.0.2 is the latest release and still declares glob ^10; archiver@8 and the latest testcontainers don't change that, so a parent upgrade can't reach glob 14 yet. This adds one scoped override, 'archiver-utils>glob': 14.0.2, next to the existing prool>tar one, with a note to remove it when upstream upgrades.
• archiver-utils only calls glob.sync(pattern, options), which glob 14 still exports.
• Lockfile regenerated with pnpm 11.1.0 (the repo's packageManager); only glob's subtree changed (glob, minimatch, path-scurry, lru-cache, brace-expansion, balanced-match, @isaacs/nonrecursive-glob-match added; jackspeak, @isaacs/cliui and friends dropped). Resolved versions are all more than 7 days old.

Checked: pnpm install --frozen-lockfile --ignore-scripts passes; in localnet, archiver-utils resolves glob 14.0.2, file.expand matches files, and archiver('tar').glob(...) produces an archive.

[tempoxyz-bot]

👁️ Cyclops Security Review

✅ Reviewed 637a2cb (latest) · Coverage: partial · no open findings · report
⚠️ Not checked: Push from glob 14.0.2 to 14.0.3 in the archiver-utils override: ruled out without reading the cited code at this commit
ℹ️ Not verifiable from the source alone (needs running code or deployed state): The previously executed smoke check exercises the shipped glob.sync export and basic filesystem matching only. Frozen-lockfile installation, complete archive creation, and Docker-backed localnet start

#	Severity	Finding	Introduced	Status
1	⚪ Informational	glob 14.0.2 override runs an inlined minimatch older than pinned 11.0.4	e4327bb	✅ Fixed in 637a2cb

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[claude]

I re-reviewed the new commit that moves the pin to glob 14.0.3 and didn't find any bugs. The override forces archiver-utils 5 four major versions past its declared glob ^10, so a human should still check that glob 14 works with it before merging.

What was reviewed:

• The lockfile matches the new 'archiver-utils>glob': 14.0.3 override. archiver-utils@ 5.0.2 now resolves glob 14.0.3, and the only churn is glob's own subtree: minimatch 11, path-scurry 3, lru-cache 11 and brace-expansion 5 came in, and the jackspeak/cliui chain went out.
• The new engine floors (node 20 || >=22) are met by the repo's Node 22 toolchain.
• Not checked: the package sources aren't in this checkout, so I couldn't confirm by reading that glob 14 still exposes require('glob').sync, and I didn't confirm the release age of 14.0.3. I also didn't run pnpm install --frozen-lockfile or pnpm verify. The PR title and description still say 14.0.2.

Extended reasoning...

The change adds one scoped pnpm override in pnpm-workspace.yaml and regenerates pnpm-lock.yaml. It affects only glob's dependency subtree under testcontainers/archiver in localnet and touches no source code and no auth, crypto or data-handling surface. It isn't an approval because the override pushes a transitive dependency outside its consumer's declared semver range, and I couldn't confirm by reading that glob 14 is API-compatible with archiver-utils 5. There is also an earlier inline comment from another reviewer on pnpm-workspace.yaml whose content I can't see, so I can't tell whether the follow-up commit addressed it.