[anurag629]

What and why

Clears Dependabot alerts #87 and #85.

• minimatch below 11.0.1 (GHSA-g3hv-75wg-m249, denial of service via globparts amplification). We had 9.0.9 under @node-minify/core, and 10.2.6 under glob 13 and under @typescript-eslint/typescript-estree.
• glob 9.0.0 through 14.0.1 (GHSA-3g3m-2fjr-6pw4, AbortSignal cancellation bypass). We had 10.5.0 under @node-minify/core and 13.0.6 from @opennextjs/cloudflare.

No parent can move to a fixed range yet. The newest @opennextjs/cloudflare (1.20.16) still asks for glob ^13.0.6. @opennextjs/aws 4.1.15 still pulls @node-minify/core 9, which pins glob 10.3.3. @typescript-eslint/typescript-estree 8.72.1 still asks for minimatch ^10.2.2. So this uses three scoped overrides:

• glob ^14.0.2 under @node-minify/core (the override from chore(deps): override glob under @node-minify/core to 10.5.0 #177, bumped from ^10.5.0)
• glob ^14.0.2 under @opennextjs/cloudflare
• minimatch ^11.0.1 under @typescript-eslint/typescript-estree

Both globs now resolve to 14.0.4 and every affected minimatch to 11.0.5. ESLint and its plugins keep minimatch 3.1.5. That version is outside the advisory range and has a different API, so a top level minimatch override would have broken lint.

These are major jumps for the nested copies, so I read each call site against the glob 11 to 14 and minimatch 11 changelogs. @node-minify/core only calls globSync(pattern). OpenNext uses glob and globSync with cwd, absolute, nodir, withFileTypes, windowsPathsNoEscape and one relative ignore. typescript-estree calls minimatch(path, pattern, { dot: true }). None of that changed. The breaking changes are in APIs nobody here uses (makeRe, GlobWalker, the debug option, ignore patterns that start with /), plus glob 11 dropping Node below 20, which our engines already require.

Both packages only run during the OpenNext build and lint, never in the deployed Worker, so nothing was exploitable in production.

Dependabot's own security update failed for two reasons. Looking for an upgrade path, its auditor walked back to @opennextjs/cloudflare 0.3.x through 0.6.x, and those releases depend on pkg.pr.new preview builds that now return 404. Its fallback npm update minimatch couldn't move 9.0.9 either, because our ^10.5.0 override held glob 10 in place. It then reported the top level 3.1.5 as the latest resolvable version and gave up.

How I tested this

On Node 22 and npm 10, same as CI:

• npm ci, then npm ls minimatch glob shows only glob 14.0.4 and minimatch 11.0.5 or 3.1.5. npm audit reports 0 vulnerabilities.
• npm run lint: 0 errors and 11 warnings, the same as develop.
• npm run test: 67 files, 2638 tests pass.
• npm run build and npx opennextjs-cloudflare build both pass. The manifest loader that OpenNext generates in handler.mjs lists the manifests for every route, so its glob 14 calls are finding files. The two esbuild warnings in the server bundle also show up in develop's CI.
• A short script called the overridden copies the way each parent does: globSync with withFileTypes, globSync with cwd, absolute and ignore, async glob with a pattern array and nodir, and minimatch(path, pattern, { dot: true }). All returned what they should.

npm 10 dropped the libc fields from the 8 Linux binary entries in the lockfile again (same as #177), so I put them back. Apart from the glob and minimatch subtrees, the lockfile diff removes glob 10's CLI dependencies (jackspeak, foreground-child, @isaacs/cliui and its copies of string-width and wrap-ansi). It also marks cross-spawn, which and a few others as dev only, because ESLint is now the only thing that pulls them in. No direct dependency changed version.

Notes for reviewers

The overrides can go once upstream catches up. Drop the two glob entries when OpenNext moves to glob 14 and off node-minify 9, and the typescript-estree entry when typescript-eslint moves to minimatch 11.