Skip to content

deps: bump glob from 11.1.0 to 13.0.6 in /scripts#3

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/scripts/glob-13.0.6
Closed

deps: bump glob from 11.1.0 to 13.0.6 in /scripts#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/scripts/glob-13.0.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps glob from 11.1.0 to 13.0.6.

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

@dependabot @github

dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from a team as a code owner April 13, 2026 08:09
@dependabot
deps: bump glob from 11.1.0 to 13.0.6 in /scripts
c9d7da8 
Bumps [glob](https://github.com/isaacs/node-glob) from 11.1.0 to 13.0.6.
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.1.0...v13.0.6)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 13.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/scripts/glob-13.0.6 branch from b93168d to c9d7da8 Compare April 13, 2026 11:58
@dependabot
dependabot Bot requested a review from ksroda-sa as a code owner April 13, 2026 11:58
@dependabot @github

dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like glob is up-to-date now, so this is no longer needed.

@ksroda-sa ksroda-sa closed this Apr 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/scripts/glob-13.0.6 branch April 13, 2026 12:13
@dependabot @github

dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@ksroda-sa ksroda-sa mentioned this pull request May 18, 2026
Merged
ksroda-sa added a commit that referenced this pull request May 18, 2026
@ksroda-sa @claude
fix(deps): close 4 Dependabot alerts via transitive lockfile bumps (#177
2890ff5 
)

Bumps three lockfiles to drop the vulnerable transitive versions:

  samples/angular/login-pkce/yarn.lock
  samples/angular/token-refresh/yarn.lock
    ip-address 10.1.0 → 10.2.0 (closes alerts #2, #3 — XSS in
    Address6 HTML-emitting methods). The vulnerable 10.1.0 was
    pinned exactly by express-rate-limit@8.5.0 deep in the tree
    via @modelcontextprotocol/sdk. Bumping express-rate-limit
    recursively to 8.5.2 — which now uses ^10.2.0 — drops the
    bad pin transitively.

  samples/react-native/login-pkce/yarn.lock
    fast-xml-builder 1.1.5 → 1.2.0 (closes alerts #9, #10 —
    Comment Value regex bypass + attribute value quote bypass).
    Bumped recursively via yarn up -R.

All changes are lockfile-only (no package.json edits). All bumped
packages are build/dev tooling, not runtime — the apps' shipped
code is unchanged.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ksroda-sa ksroda-sa Awaiting requested review from ksroda-sa ksroda-sa is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ksroda-sa