From d449371fa93b87eb2cbca5de6d74c860c42194b9 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Wed, 4 Nov 2026 16:43:29 +0100
Subject: [PATCH] fix(deps): override minimatch to ^11.0.1 for
 GHSA-g3hv-75wg-m249

Dependabot alert 18 flags minimatch < 11.0.1 (medium, dev scope). It
enters only through eslint (^10.2.6) and @eslint/config-array
(^10.2.4), and the newest releases of both (eslint 10.14.0,
config-array 0.23.5) still require 10.x, so no upstream bump fixes it.

An npm override pins both onto minimatch 11.0.4, which adds the
BlueOak-1.0.0 dependency @isaacs/nonrecursive-glob-match and needs
Node 20 or newer; utils.install.node installs the newest LTS.

eslint over roles/**/files/**/*.js reports the same 545 files and the
same 187 messages (rule, line, column) before and after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 package-lock.json | 18 +++++++++++++-----
 package.json      |  3 ++-
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f6f2f7668e..057322cb1b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -421,6 +421,13 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz",
+      "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@keyv/bigmap": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
@@ -1636,16 +1643,17 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.4.tgz",
+      "integrity": "sha512-/UJ1dEoVQTjPNDh6SGlUo+ueLMmoHTas4q+8yaAR/5t6nLAIiBDJtoYUh20IYleix7ehiQkgczb84PE3uzHkxg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.0.3",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
diff --git a/package.json b/package.json
index 51b1424985..5f547a2e88 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,7 @@
     "stylelint": "^17.16.0"
   },
   "overrides": {
-    "brace-expansion": "^5.0.12"
+    "brace-expansion": "^5.0.12",
+    "minimatch": "^11.0.1"
   }
 }