fix(deps): update module github.com/bmatcuk/doublestar/v4 to v4.10.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/bmatcuk/doublestar/v4	v4.9.1 → v4.10.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

bmatcuk/doublestar (github.com/bmatcuk/doublestar/v4)

v4.10.0: Added WithNoHidden option

Compare Source

Added support for a WithNoHidden option to ignore hidden files in patterns that might unintentionally match them. For example, a .config directory would not be matched by * or recursed into by **, but would be matched by .* or recursed by .config/**.

Thanks to @​lukasngl for the initial PR and idea!

What's Changed

• feat: add WithNoHidden option to skip hidden files by @​lukasngl in #​109

New Contributors

• @​lukasngl made their first contribution in #​109

Full Changelog: bmatcuk/doublestar@v4.9.2...v4.10.0

v4.9.2: Fixed Handling of Paths With Meta Chars Using Alts

Compare Source

@​toga4 submitted a PR that fixed a small bug with the way paths were handled when the pattern used {alts}: if some part of the on-disk path that came before the {alt} included meta characters (say, a directory name that included the character ?), these meta characters were not escaped when they were passed back through the globbing routines. This caused doublestar to interpret them as actual meta characters, rather than a fixed-string path as it should have. Nice find, @​toga4 !

What's Changed

• fix: escape meta characters in paths during brace expansion by @​toga4 in #​108

New Contributors

• @​toga4 made their first contribution in #​108

Full Changelog: bmatcuk/doublestar@v4.9.1...v4.9.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pikachuren]

🙏 感谢 @renovate 提交！

🤖 AI 自动审核声明：本评审报告由 AI 自动生成，当前使用 Claude Opus 5 模型进行分析。

⚠️ AI 分析结果仅供参考，可能存在误判或遗漏。如您发现任何问题或有不同意见，欢迎随时提出讨论和纠正。

⚠️ 重要提醒：即使 AI 评审认为代码质量良好且建议合并，最终是否合并仍需由项目维护者进行人工判定。

---

🎯 结论

建议合并（Approve）。这是一次干净的补丁级依赖升级，已完成上游 diff 的供应链核查，未发现异常。CI 全部通过。

📖 概要

将 github.com/bmatcuk/doublestar/v4 从 v4.9.1 升级到 v4.10.0。doublestar 在本项目中用于路径通配符匹配，属于基础工具库。

🧭 整体方案

Renovate 自动生成的单依赖升级，仅触碰 go.mod 与 go.sum，不涉及任何业务代码改动，是依赖治理中最理想的变更形态。

📊 变更统计

• 文件：2 个（go.mod、go.sum）
• 行数：+3 / -1

维度	评分	说明
功能	⭐⭐⭐⭐⭐	依赖保鲜，获得上游新特性与修复
最小改动	⭐⭐⭐⭐⭐	仅版本号，无冗余改动
前向兼容	⭐⭐⭐⭐⭐	minor 升级，上游未见破坏性 API 变更
方案设计	⭐⭐⭐⭐⭐	自动化依赖管理的标准做法

🚨 关键问题

P0 阻塞问题

无。

P1 建议修复

无。

P2 可选优化

无。

🔐 依赖安全审查

对 v4.9.1...v4.10.0 的上游 diff 做了逐文件核查，结论是未发现供应链投毒迹象：

1. 变更文件清单（14 个）：均为该库的正常演进，新增的是平台相关实现与对应测试。

文件	变更	性质
utils_unix.go / utils_windows.go	新增	平台特定的隐藏文件判定
utils_unix_test.go / utils_windows_test.go	新增	对应单测
glob.go / globwalk.go / globoptions.go	修改	新增匹配选项
README.md / .github/workflows/test.yml	修改	文档与 CI

2. 恶意模式扫描：对新增行 grep 了 exec.Command、os/exec、http.Post(、http.Get(、base64.、net.Dial、InsecureSkipVerify、.onion 等模式。唯一命中的是 utils_windows.go 中的 syscall 调用：

attributes, err := syscall.GetFileAttributes(pointer)
return stat.FileAttributes&syscall.FILE_ATTRIBUTE_HIDDEN != 0, nil

这是 Windows 下判定「隐藏文件」属性的标准 Win32 API 用法，与本次新增的隐藏文件过滤特性功能自洽，无外部网络行为、无命令执行、无编码混淆。

3. 依赖树：本次升级未引入任何新的间接依赖，go.sum 仅新增该模块自身的两行哈希。

4. 模块归属：github.com/bmatcuk/doublestar 仍为原作者仓库，未发生仓库迁移或 fork 替换。

📂 逐文件分析

go.mod

改动意图：提升 doublestar 主版本约束。

代码逻辑：

-	github.com/bmatcuk/doublestar/v4 v4.9.1
+	github.com/bmatcuk/doublestar/v4 v4.10.0

问题分析：无。该依赖位于直接依赖区块，位置正确。

详细建议：无需改动。

go.sum

改动意图：登记新版本的模块哈希。

代码逻辑：新增 v4.10.0 的 h1: 与 /go.mod h1: 两行。值得注意的是 /go.mod 哈希与 v4.9.1 完全一致（xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=），说明上游 go.mod 内容未变，进一步印证了「未引入新依赖」的判断。

问题分析：无。

详细建议：无需改动。

✅ 待处理清单

• 上游 diff 供应链核查
• 恶意模式扫描
• 新增间接依赖核对
• CI 构建验证（全平台通过）

无待办事项。

---

🎯 结论：建议合并。纯净的补丁级升级，供应链核查通过，CI 全绿，无任何阻塞项。再次感谢您对依赖保鲜的持续维护！

[pikachuren]

经 AI 评审与上游供应链核查确认无异常，CI 全绿，批准合并。详见此前评审报告。