[minimaluminium]

Updates vulnerable transitive dependencies to patched versions and regenerates the pnpm lockfile. Pins minimatch 11.0.4 for affected consumers; this version meets the release-age policy.

Also updates bestzip’s glob to 14.0.4 for GHSA-3g3m-2fjr-6pw4, found by a fresh audit.

Addresses Dependabot alerts: 146.

Validation: pnpm install --frozen-lockfile passes. pnpm test:ci passes. The only remaining audit finding is deepmerge GHSA-gcqx-w48m-w2h4: its CVE record was rejected on 2026-11-02 because it does not describe a security vulnerability. No downgrade or audit suppression is applied.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The workspace configuration adds an override that maps minimatch requests matching >=7 <11.0.1 to 11.0.4. It also maps bestzip’s glob dependency to 14.0.4. Comments describe the dependency paths associated with the overrides.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: Minimal · up to 0d206

The dependency updates preserve the inspected archive-tool interfaces. No merge-blocking risk was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly describes the change: fixing vulnerable build dependencies.
Description check		The description explains the dependency updates, the security findings they address, and the reported validation results.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b1f6c699-8108-4e5c-a601-d1505b6b7c5a

Commits

Reviewing files that changed from the base of the PR and between 64b98aa and 0d20614.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.