Repository navigation
🔒 Update glob to 14.0.2 - #391
Merged
Robdel12 merged 2 commits intoNov 2, 2026
Merged
Conversation
Bumps the security-dependencies group with 1 update in the / directory: [glob](https://github.com/isaacs/node-glob). Updates `glob` from 13.0.6 to 14.0.2 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v13.0.6...v14.0.2) --- updated-dependencies: - dependency-name: glob dependency-version: 14.0.2 dependency-type: direct:production dependency-group: security-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Permit the four locked versions needed for the glob security upgrade without changing the seven-day release-age policy for other releases. Verify installed plugin discovery and recursive PNG uploads with real files.
Robdel12
changed the title
Robdel12
deleted the
dependabot/npm_and_yarn/security-dependencies-eed209fbe8
branch
November 2, 2026 05:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The CLI's glob dependency is affected by GHSA-3g3m-2fjr-6pw4: cancelled walks can keep reading directories after rejecting. Glob 14.0.2 fixes that behavior and brings in minimatch 11.0.4, which is outside the vulnerable range for GHSA-g3hv-75wg-m249.
Approach
Upgrade the direct glob dependency and its lockfile entries. Allow exactly glob 14.0.2, minimatch 11.0.4, @isaacs/nonrecursive-glob-match 1.0.3, and path-scurry 3.0.0 through the release-age check. CI previously stopped at installation because all four releases were newer than seven days; the normal waiting period remains in place for other versions.
Exercise both glob callers with real files: installed Vizzly plugin discovery and recursive screenshot uploads that exclude non-PNG files.
Evidence
The frozen install passes supply-chain verification, peer checks are clean, and lint, formatting, the production build, the full Node suite, and published type checks pass locally on Node 24.
Older transitive glob and minimatch versions remain in build-tool dependencies. This PR fixes the direct runtime dependency; those remaining dependency paths need separate updates.