[julien-deramond]

Dependabot reports GHSA-g3hv-75wg-m249 on minimatch (moderate, denial of service through **/.. patterns), affecting every version from 7.0.0 up to 11.0.1. Seven copies in our dev tree were affected (9.0.9, 10.2.5, 10.2.6), and the fix only exists in minimatch 11, a major release that none of their parents accept yet. This moves them all to 11.0.7.

eslint-plugin-import-x 4.18.1 already accepts minimatch 11, so it gets a normal bump. ESLint (with @eslint/config-array), @typescript-eslint/typescript-estree, markdownlint-cli and nodemon still declare ^10, so they get scoped npm overrides, the same approach as re2js. They only call minimatch(), new Minimatch() with .match(), and .pattern, which 11 keeps. Version 11 removes makeRe(), Minimatch#regexp, AST and matchOne(), and none of them use those.

jasmine is the exception. Every glob version it allows (10 to 13) needs minimatch 10 or lower and reads Minimatch#set as RegExps, which 11 changes. So jasmine's own glob is overridden to 14.0.4, which depends on minimatch 11. The root minimatch 3.1.5 (for glob 7) isn't in the affected range and stays as it is.

The overrides can go once ESLint, markdownlint-cli, nodemon and jasmine accept minimatch 11 themselves.

Notes: what was checked, and how to check it again

Each check was run on main and on this branch, with the same results:

Check	Before	After
eslint --report-unused-disable-directives .	147 files, 0 errors, 7 warnings	147 files, 0 errors, 7 warnings
markdownlint (docs-mdx, docs-md)	passes	passes
npm run css-test (jasmine, glob 14)	48 specs, 0 failures	48 specs, 0 failures
npm run lockfile-lint	passes	passes

nodemon's matcher was checked directly on minimatch 11. With scss/**/* and the scss extension, it keeps scss/_root.scss and leaves out js/src/x.js and scss/a.css.

The JS tests, the docs build and the watch-* scripts weren't run locally. CI covers the first two.

How to check it again

npm ci
node -e 'const l=require("./package-lock.json").packages;for(const[p,v]of Object.entries(l))if(p.endsWith("node_modules/minimatch"))console.log(p,v.version)'
npx eslint --report-unused-disable-directives -f json . | node -e 'const r=JSON.parse(require("fs").readFileSync(0));console.log(r.length,"files",r.reduce((a,x)=>a+x.errorCount,0),"errors")'
npm run css-test

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for twbs-bootstrap ready!

Name	Link
🔨 Latest commit	2592935
🔍 Latest deploy log	https://app.netlify.com/projects/twbs-bootstrap/deploys/6af43c62b40b88166d052fb2
😎 Deploy Preview	https://deploy-preview-43349--twbs-bootstrap.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.