[claude]

Requested by Mike Maietta · Slack thread

main already took minimatch ^11.0.1 in #495, but glob 13 still pulls in minimatch 10.2.5 at runtime, and GHSA-g3hv-75wg-m249 is only patched in minimatch 11.0.1 and later. glob 14.0.3 is the first glob release on minimatch ^11.0.2, so with this bump from ^13.0.2 to ^14.0.3 asar's runtime tree has only minimatch 11.x, which clears the alert electron-builder users see through asar (electron-userland/electron-builder#10537). One caveat: glob 14.0.3 and path-scurry 3.0.0 are less than 7 days old, younger than the npmMinimalAgeGate in .yarnrc.yml, so I resolved the lockfile once with the gate off; yarn install --immutable passes with it on.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	glob@​13.0.6 ⏵ 14.0.3	+3	+2	+1
	minimatch@​11.0.3

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Recently published: npm @isaacs/nonrecursive-glob-match published 3 days ago Location: Package overview From: package.json → npm/minimatch@11.0.3 → npm/@isaacs/nonrecursive-glob-match@1.0.3 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@isaacs/nonrecursive-glob-match@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm glob published 4 days ago Location: Package overview From: package.json → npm/glob@14.0.3 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@14.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm minimatch published 3 days ago Location: Package overview From: package.json → npm/minimatch@11.0.3 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@11.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm path-scurry published 4 days ago Location: Package overview From: package.json → npm/glob@14.0.3 → npm/path-scurry@3.0.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/path-scurry@3.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Low adoption: npm @isaacs/nonrecursive-glob-match Location: Package overview From: package.json → npm/minimatch@11.0.3 → npm/@isaacs/nonrecursive-glob-match@1.0.3 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@isaacs/nonrecursive-glob-match@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[claude]

I reviewed this PR and didn't find any bugs. It's still worth a human look: it moves two runtime dependencies up a major version and adds a new transitive package, @ isaacs/nonrecursive-glob-match. The lockfile was also resolved with the 7-day npmMinimalAgeGate turned off, so a maintainer should sign off on taking releases this new.

What was reviewed:

• The package.json ranges and the yarn.lock changes. glob 14.0.3 now pulls in minimatch ^11.0.2 and path-scurry ^3.0.0. minimatch 10.2.5 stays in the lockfile only for the ^10.2.4 range.
• The places where the source uses these packages: minimatch and GlobOptionsWithFileTypesFalse in src/asar.ts, and glob in src/crawlfs.ts. This is a small API surface, but I couldn't confirm the new versions' engine fields here against the project's >=22.12.0 requirement.

Extended reasoning...

The change touches only package.json and yarn.lock. It bumps glob from ^13 to ^14 and minimatch from ^10 to ^11, which also brings in path-scurry 3 and a new transitive package. No auth or crypto code changes, but this is a dependency and supply-chain change. The versions are only a few days old, and the PR says they were resolved with the repository's minimum-age gate turned off. All files are covered by a CODEOWNERS entry, so I deferred to a maintainer instead of approving.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[claude]

Superseded by #495 (minimatch ^11.0.1) and #494 (glob ^14.0.2), which leave asar's runtime tree on minimatch 11.x only. Closing. Note that build(deps) commits don't cut a semantic-release, so consumers won't pick this up until the next fix/feat release.

---

Generated by Claude Code