From 5494e7884bfb37b0277407c410c95bb583f065e9 Mon Sep 17 00:00:00 2001
From: tidy-dev <75402236+tidy-dev@users.noreply.github.com>
Date: Wed, 4 Nov 2026 13:32:38 -0500
Subject: [PATCH] fix: override vulnerable minimatch under glob

Keep Jest's glob dependency on a fixed minimatch release without changing the unrelated minimatch 3 copies.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 package-lock.json | 41 +++++++++++++++++++++++++++++++----------
 package.json      |  5 ++++-
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 9a6b740..8f15289 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -621,6 +621,13 @@
         "node": ">=12"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
+      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@istanbuljs/load-nyc-config": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
@@ -1879,13 +1886,26 @@
       "license": "Apache-2.0"
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
-      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/brace-expansion/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha1-v7EGYv7tgZaixi58aOF3IMJ0F5o=",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/browserslist": {
@@ -3523,16 +3543,17 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
+      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "@isaacs/nonrecursive-glob-match": "^1.0.2",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
diff --git a/package.json b/package.json
index bd48f8b..1979c27 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,10 @@
   "overrides": {
     "undici": "^6.29.1",
     "handlebars": "^4.7.10",
-    "js-yaml": "4.3.2"
+    "js-yaml": "4.3.2",
+    "glob@^10": {
+      "minimatch": "^11.0.1"
+    }
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",