[dependabot]

Bumps glob from 13.0.6 to 14.0.2.

Changelog

Sourced from glob's changelog.

changeglob

14

• Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
• Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
• Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
• Remove the debug option, which minimatch no longer has.
• Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
• GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
• ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
• ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
• On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
• Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
• Allow const string[] or readonly string[] as ignore option or pattern argument.
• When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

... (truncated)

Commits

• 93957bf 14.0.2
• 4682e8c fix: do not continue walking after signal abort
• 668a669 14.0.1
• 6ff2314 allow const/readonly string[] for ignore, patterns
• bbe1e5d 14.0.0
• d9586ad use actual published deps, not symlinks
• 8b16637 handle long unc forms
• 5bcdc65 extglobs cannot contain /
• d8b40c2 handle root in platform-independent way, for ignores and patterns
• 7d1c45a add native fs glob test (todo on failure)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	glob@​13.0.6 ⏵ 14.0.2	+3	+2	+1	-8

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• minimatch@11.0.3
• glob@14.0.2
• path-scurry@3.0.0

View full report

[MarshallOfSound]

@SocketSecurity ignore-all

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[claude]

🟡 (optional) Consumers passing globOptions to createPackageWithOptions get glob 14's breaking behavior and types in what ships as a non-major asar release. The globOptions field (src/asar.ts:47) is glob's own GlobOptionsWithFileTypesFalse, and src/crawlfs.ts:32 forwards it unchanged. So glob 14 drops debug, re-roots ignore patterns starting with /, applies windowsPathsNoEscape: true to ignore, and changes matching to minimatch 11. Fix: publish this as a breaking asar release (e.g. a !/BREAKING CHANGE commit), or keep glob ^13 until a planned major.

Why this was flagged

An asar API caller such as electron-builder or Forge passes globOptions: { ignore: [...] } or debug through createPackageWithOptions. src/asar.ts:63-68 hands them to crawlFilesystem, and src/crawlfs.ts:32-35 spreads them into glob() after windowsPathsNoEscape: true. With glob 14, backslash-escaped ignore entries are now read as path separators on Windows. ignore entries starting with / now resolve against root, and debug is a TypeScript error. Files the caller excluded on 13.0.6 can now end up in the archive, or included files can drop out. The release workflow (.github/workflows/release.yml) runs semantic-release, and a build(deps): commit does not cut a major version, so ^ ranges in downstream projects pick this up automatically. No source change or test adapts or documents the new semantics.

Verification: Trigger: a programmatic asar caller passes globOptions. crawl spreads it into glob(dir, { windowsPathsNoEscape: true, ...options }) (src/crawlfs.ts:32-35). The diff changes "glob": "^13.0.2" to "^14.0.2". This commit is typed build(deps): with no breaking marker. The result is that consumers' ignore sets can silently include or exclude different files, all without a major bump.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

Still open from earlier reviews (1):

• Unresolved: 1 minor or pre-existing.

[AviVahl]

@MarshallOfSound any chance for a release containing this and #495 to resolve the minimatch security vulnerabilities?

this is also awaited by electron-builder.