fix(deps): update vulnerable npm packages in package-lock.json

osv-scanner.toml

@@ -106,3 +106,24 @@ reason = "deepmerge 4.3.1 runs only at build time: vite-plugin-svelte merges pro
 id = "GHSA-ccrj-gw8r-854m"
 ignoreUntil = 2026-11-30
 reason = "CALM Hub turns off the OpenTelemetry SDK by default, and Quarkus then does not parse inbound tracestate headers. Deployments that set CALM_OTEL_DISABLED=false are exposed until Quarkus manages OpenTelemetry >= 1.67.0. Remove when the Quarkus BOM moves to it."
+
+# glob 13.0.6 is bundled inside npm 11.21.1, which comes in only through
+# @semantic-release/npm for the CLI release job. npm overrides cannot change a bundled
+# dependency, and no npm 11.x release bundles the fix (14.0.2). The flaw is that an
+# aborted walk keeps reading directories, and npm never passes a signal to glob. The
+# root glob copy is overridden to 14.x.
+[[IgnoredVulns]]
+id = "GHSA-3g3m-2fjr-6pw4"
+ignoreUntil = 2026-12-31
+reason = "glob 13.0.6 is bundled in npm under @semantic-release/npm, used only by the CLI release job. npm never passes an AbortSignal to glob, so the abort bypass cannot occur. Not shipped. Remove when an npm release bundles glob >= 14.0.2."
+
+# minimatch has no fix below 11.0.1. The root copy is overridden to 11.x. Two kinds of
+# copy remain. 3.1.5 (eslint and its plugins, @stoplight/spectral-core, serve-handler)
+# cannot take an override, because minimatch 11 has a different export shape, and it does
+# not contain the vulnerable code: the globParts amplification is in the optimizationLevel 2
+# preprocessing that minimatch 7 added. 10.2.5 is bundled inside npm 11.21.1 for the CLI
+# release job, and npm never sets optimizationLevel, so it stays at the default of 1.
+[[IgnoredVulns]]
+id = "GHSA-g3hv-75wg-m249"
+ignoreUntil = 2026-12-31
+reason = "minimatch 3.1.5 has no optimizationLevel preprocessing, so the vulnerable code is not present. minimatch 10.2.5 is bundled in npm for the CLI release job only, and npm never sets optimizationLevel 2. Remove when eslint, spectral-core and serve-handler move off minimatch 3 and an npm release bundles minimatch >= 11.0.1."

package.json

@@ -111,6 +111,7 @@
         "esbuild": "^0.28.2",
         "esrap": "2.2.11",
         "fast-uri": "^3.1.8",
+        "glob": "^14.0.2",
         "joi": "^17.13.8",
         "js-yaml": "^4.3.2",
         "on-headers": "^1.1.0",
@@ -120,6 +121,7 @@
         "lodash": "^4.18.1",
         "lodash-es": "^4.18.1",
         "markdown-it": "^14.3.1",
+        "minimatch@^10.0.0": "^11.0.1",
         "picomatch": "^4.0.7",
         "postcss": "^8.5.29",
         "sharp": "^0.35.0",

vex/calm.openvex.json

@@ -3,8 +3,8 @@
   "@id": "https://github.com/finos/architecture-as-code/blob/main/vex/calm.openvex.json",
   "author": "Architecture as Code (CALM) Maintainers",
   "role": "Project maintainers",
-  "timestamp": "2026-10-29T00:00:00Z",
-  "version": 19,
+  "timestamp": "2026-11-02T00:00:00Z",
+  "version": 20,
   "tooling": "Maintained by hand alongside osv-scanner.toml",
   "statements": [
     {
@@ -305,7 +305,86 @@
       "status_notes": "Review again by 2026-11-30, when the suppression in osv-scanner.toml expires.",
       "justification": "vulnerable_code_not_in_execute_path",
       "impact_statement": "opentelemetry-api 1.62.0 comes in through the Quarkus 3.40 BOM. The flaw is quadratic CPU use when the W3C propagator parses an inbound tracestate header. CALM Hub turns off the OpenTelemetry SDK by default (CALM_OTEL_DISABLED=true). Quarkus then builds a no-op SDK and disables the HTTP server instrumenter, so it does not parse tracestate. A deployment that sets CALM_OTEL_DISABLED=false is exposed. The fix (1.67.0) cannot be overridden, because Quarkus 3.40 does not start with OpenTelemetry 1.67. It needs a Quarkus release that manages OpenTelemetry 1.67.0 or later."
+    },
+    {
+      "vulnerability": {
+        "name": "GHSA-3g3m-2fjr-6pw4",
+        "aliases": [
+          "CVE-2026-118773"
+        ]
+      },
+      "products": [
+        {
+          "@id": "pkg:npm/%40finos/calm-cli",
+          "subcomponents": [
+            {
+              "@id": "pkg:npm/glob@13.0.6"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "Review again by 2026-12-31, when the suppression in osv-scanner.toml expires.",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "glob 13.0.6 is bundled inside npm 11.21.1, which is pulled in only by @semantic-release/npm for the CLI release job. It is not part of the published @finos/calm-cli package. npm overrides cannot change a bundled dependency, and no npm 11.x release bundles the fix (14.0.2). The flaw is that a walk keeps reading directories after its AbortSignal fires. npm never passes a signal to glob, so no walk is aborted. The other glob copy in the lockfile is 14.0.3, which has the fix."
+    },
+    {
+      "vulnerability": {
+        "name": "GHSA-g3hv-75wg-m249",
+        "aliases": [
+          "CVE-2026-118764"
+        ]
+      },
+      "products": [
+        {
+          "@id": "pkg:npm/%40finos/calm-cli",
+          "subcomponents": [
+            {
+              "@id": "pkg:npm/minimatch@3.1.5"
+            },
+            {
+              "@id": "pkg:npm/minimatch@10.2.5"
+            }
+          ]
+        },
+        {
+          "@id": "pkg:github/finos/architecture-as-code#calm-plugins/vscode",
+          "subcomponents": [
+            {
+              "@id": "pkg:npm/minimatch@3.1.5"
+            }
+          ]
+        },
+        {
+          "@id": "pkg:github/finos/architecture-as-code#calm-lab",
+          "subcomponents": [
+            {
+              "@id": "pkg:npm/minimatch@3.1.5"
+            }
+          ]
+        },
+        {
+          "@id": "pkg:npm/%40finos/calm-docusaurus-plugin",
+          "subcomponents": [
+            {
+              "@id": "pkg:npm/minimatch@3.1.5"
+            }
+          ]
+        },
+        {
+          "@id": "pkg:github/finos/architecture-as-code#docs",
+          "subcomponents": [
+            {
+              "@id": "pkg:npm/minimatch@3.1.5"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "Review again by 2026-12-31, when the suppression in osv-scanner.toml expires.",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "The flaw is unbounded growth of globParts in the preprocessing that minimatch runs at optimizationLevel 2 or higher. minimatch 3.1.5 comes in through @stoplight/spectral-core (in @finos/calm-shared, so the CLI, the VS Code extension and CALM Lab), serve-handler (Docusaurus), and eslint and its plugins (development only). minimatch 3 has no optimizationLevel option and no such preprocessing, so the vulnerable code is not present. An override to 11.x is not possible, because minimatch 11 has a different export shape. minimatch 10.2.5 is bundled inside npm 11.21.1, which is pulled in only by @semantic-release/npm for the CLI release job and is not part of the published package. npm never sets optimizationLevel, so the default of 1 applies and the vulnerable code does not run. The other minimatch 10 copies are overridden to 11.0.4, which has the fix."
     }
   ],
-  "last_updated": "2026-10-29T00:00:00Z"
+  "last_updated": "2026-11-02T00:00:00Z"
 }