🔒 Update glob to 14.0.2

package.json

@@ -102,7 +102,7 @@
     "cosmiconfig": "^10.0.1",
     "dotenv": "^18.0.9",
     "form-data": "^4.0.6",
-    "glob": "^13.0.6",
+    "glob": "^14.0.2",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "zod": "^4.6.7"

pnpm-workspace.yaml

@@ -19,10 +19,14 @@ overrides:
 minimumReleaseAge: 10080
 minimumReleaseAgeStrict: true
 minimumReleaseAgeIgnoreMissingTime: false
-# These exact security fixes are newer than the normal seven-day waiting period.
+# These security fixes and their required dependencies are newer than seven days.
 minimumReleaseAgeExclude:
+  - '@isaacs/nonrecursive-glob-match@1.0.3'
   - body-parser@2.4.0
   - fast-uri@3.1.9
+  - glob@14.0.2
+  - minimatch@11.0.4
+  - path-scurry@3.0.0
 onlyBuiltDependencies:
   - canvas
   - esbuild

src/adapters/plugins/plugin-loader.test.js

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { afterEach, beforeEach, describe, it } from 'node:test';
 import {
   loadPlugin,
+  loadPlugins,
   resolvePackagePluginPath,
   resolvePluginPath,
 } from './plugin-loader.js';
@@ -38,6 +39,26 @@ describe('plugin-loader', () => {
     await rm(workspace, { recursive: true, force: true });
   });
 
+  it('loads installed plugins from the Vizzly package scope', async () => {
+    let packageDir = await writePackage(workspace, '@vizzly-testing/example', {
+      name: '@vizzly-testing/example',
+      type: 'module',
+      vizzlyPlugin: 'plugin.js',
+    });
+    await writeFile(
+      join(packageDir, 'plugin.js'),
+      `export default { name: 'installed-plugin', register() {} };`
+    );
+
+    let plugins = await loadPlugins(null, {});
+
+    assert.deepEqual(
+      plugins.map(plugin => plugin.name),
+      ['installed-plugin']
+    );
+    assert.equal(typeof plugins[0].register, 'function');
+  });
+
   describe('resolvePackagePluginPath', () => {
     it('resolves package plugin paths inside the package directory', () => {
       let packageDir = join(workspace, 'node_modules', 'storybook-plugin');

tests/cli/uploads/upload-cli.test.js

@@ -33,12 +33,14 @@ describe('commands/upload CLI', () => {
     assert.match(result.stderr, /API token required/);
   });
 
-  it('uploads screenshots and finalizes the build through the CLI', async () => {
+  it('uploads nested PNG screenshots and finalizes the build through the CLI', async () => {
     let workspace = mkdtempSync(join(tmpdir(), 'vizzly-cli-upload-'));
     let screenshots = join(workspace, 'screenshots');
     mkdirSync(screenshots);
+    mkdirSync(join(screenshots, 'nested'));
     writeFileSync(join(screenshots, 'home-chrome.png'), 'png');
-    writeFileSync(join(screenshots, 'settings-firefox.png'), 'png');
+    writeFileSync(join(screenshots, 'nested', 'settings-firefox.png'), 'png');
+    writeFileSync(join(screenshots, 'nested', 'notes.txt'), 'not a screenshot');
 
     await withUploadApiServer(async ({ apiUrl, requests }) => {
       let result = await runCLI(