Fix minimatch security audit

[melroy89]

minimatch  10.0.0 - 10.2.2
Severity: high
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74

[luc-LMZ]

It will be really good to have this merged

[melroy89]

It will be really good to have this merged

I agree of course..

[chipach]

@isaacs - Any change this could get merged, pretty please?

[danifandinonearpod]

Hi, with the last audit errors, the idea is use minimatch 10.2.6

[isaacs]

Do package managers not update transitive deps with an update command anymore? What the hell. The update is allowed by the server range. These noisy PRs and pleading comments are super annoying. Go tell your package manager to do its job.

[isaacs]

I’m 100% not going to accept a PR that updates the lock file and nothing else. That is a giant pile of red flags.

[melroy89]

Do package managers not update transitive deps with an update command anymore? What the hell. The update is allowed by the server range. These noisy PRs and pleading comments are super annoying. Go tell your package manager to do its job.

No they don't. Especially not when there is a dependency of a dependency. And/or when you use pnpm etc.

Not sure why the lock file is part of the npm package (git repo is fine of course).

[isaacs]

No they don't.

Have you tried running npm update? Or just deleting the lockfile and reinstalling (which is what npm update does)?

Not sure why the lock file is part of the npm package

It's not.