chore: updating minimatch (#19434)

- Adding a devDependency on minimatch in the root, so that all outdated
versions get pushed into duplicates.
- Updated `minimatch` direct dependency packages/node,
packages/react-router, and packages/remix
- Once getsentry/sentry-javascript-bundler-plugins#885 lands, we can
update the dependency coming in from `@sentry/bundler-plugin-core`

There are several other dependencies that transitively bring in a
minimatch v3, v5, v8, or v9. Fixes for the ReDOS will be backported
where those dependencies cannot be easily updated.

Before submitting a pull request, please take a look at our

[Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md)
guidelines and verify:

- [ ] If you've added code that should be tested, please add tests.
- [ ] Ensure your code lints and the test suite passes (`yarn lint`) &
(`yarn test`).
- [ ] Link an issue if there is one related to your pull request. If no
issue is linked, one will be auto-generated and linked.

Closes #issue_link_here

Author: isaacs

dev-packages/browser-integration-tests/package.json

@@ -69,10 +69,9 @@
     "webpack": "^5.95.0"
   },
   "devDependencies": {
-    "@types/glob": "8.0.0",
     "@types/node": "^18.19.1",
     "eslint-plugin-regexp": "^1.15.0",
-    "glob": "8.0.3"
+    "glob": "^13.0.6"
   },
   "volta": {
     "extends": "../../package.json"

dev-packages/browser-integration-tests/scripts/detectFlakyTests.ts

@@ -1,7 +1,7 @@
 import * as childProcess from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
-import * as glob from 'glob';
+import { globSync } from 'glob';
 
 /**
  * Assume that each test runs for 3s.
@@ -112,7 +112,7 @@ function getPerTestRunCount(testPaths: string[]) {
 }
 
 function getTestPaths(): string[] {
-  const paths = glob.sync('suites/**/test.{ts,js}', {
+  const paths = globSync('suites/**/test.{ts,js}', {
     cwd: path.join(__dirname, '../'),
   });
 

dev-packages/e2e-tests/package.json

@@ -21,13 +21,12 @@
     "clean:pnpm": "pnpm store prune"
   },
   "devDependencies": {
-    "@types/glob": "8.0.0",
     "@types/node": "^18.19.1",
     "dotenv": "16.0.3",
     "esbuild": "0.20.0",
     "eslint-plugin-regexp": "^1.15.0",
-    "glob": "8.0.3",
-    "rimraf": "^5.0.10",
+    "glob": "^13.0.6",
+    "rimraf": "^6.1.3",
     "ts-node": "10.9.2",
     "yaml": "2.8.2"
   },

dev-packages/e2e-tests/publish-packages.ts

@@ -1,6 +1,6 @@
 import * as childProcess from 'child_process';
 import { readFileSync } from 'fs';
-import * as glob from 'glob';
+import { globSync } from 'glob';
 import * as path from 'path';
 
 const repositoryRoot = path.resolve(__dirname, '../..');
@@ -10,7 +10,7 @@ const version = (JSON.parse(readFileSync(path.join(__dirname, './package.json'),
 
 // Get absolute paths of all the packages we want to publish to the fake registry
 // Only include the current versions, to avoid getting old tarballs published as well
-const packageTarballPaths = glob.sync(`packages/*/sentry-*-${version}.tgz`, {
+const packageTarballPaths = globSync(`packages/*/sentry-*-${version}.tgz`, {
   cwd: repositoryRoot,
   absolute: true,
 });

dev-packages/e2e-tests/validate-test-app-setups.ts

@@ -1,9 +1,9 @@
 /* eslint-disable no-console */
 import * as fs from 'fs';
-import * as glob from 'glob';
+import { globSync } from 'glob';
 import * as path from 'path';
 
-const testRecipePaths = glob.sync('test-applications/*/test-recipe.json', {
+const testRecipePaths = globSync('test-applications/*/test-recipe.json', {
   cwd: __dirname,
   absolute: true,
 });

dev-packages/e2e-tests/validate-verdaccio-configuration.ts

@@ -1,6 +1,6 @@
 import * as assert from 'assert';
 import * as fs from 'fs';
-import * as glob from 'glob';
+import { globSync } from 'glob';
 import * as path from 'path';
 import * as YAML from 'yaml';
 
@@ -19,7 +19,7 @@ const sentryScopedPackagesInVerdaccioConfig = Object.keys(verdaccioConfig.packag
   packageName.startsWith('@sentry/'),
 );
 
-const packageJsonPaths = glob.sync('packages/*/package.json', {
+const packageJsonPaths = globSync('packages/*/package.json', {
   cwd: repositoryRoot,
   absolute: true,
 });

package.json

@@ -149,6 +149,9 @@
     "we need to resolve them to the CommonJS versions."
   ],
   "resolutions": {
+    "**/nx/minimatch": "10.2.4",
+    "**/ng-packagr/postcss-url/minimatch": "3.1.5",
+    "**/@angular-devkit/build-angular/minimatch": "5.1.9",
     "gauge/strip-ansi": "6.0.1",
     "wide-align/string-width": "4.2.3",
     "cliui/wrap-ansi": "7.0.0",

packages/react-router/package.json

@@ -55,7 +55,7 @@
     "@sentry/node": "10.40.0",
     "@sentry/react": "10.40.0",
     "@sentry/vite-plugin": "^5.1.0",
-    "glob": "^13.0.1"
+    "glob": "^13.0.6"
   },
   "devDependencies": {
     "@react-router/dev": "^7.13.0",

packages/remix/package.json

@@ -72,7 +72,7 @@
     "@sentry/core": "10.40.0",
     "@sentry/node": "10.40.0",
     "@sentry/react": "10.40.0",
-    "glob": "^10.3.4",
+    "glob": "^13.0.6",
     "yargs": "^17.6.0"
   },
   "devDependencies": {

packages/remix/scripts/deleteSourcemaps.js

@@ -2,13 +2,13 @@
 const fs = require('fs');
 const path = require('path');
 
-const glob = require('glob');
+const { globSync } = require('glob');
 
 function deleteSourcemaps(buildPath) {
   console.info(`[sentry] Deleting sourcemaps from ${buildPath}`);
 
   // Delete all .map files in the build folder and its subfolders
-  const mapFiles = glob.sync('**/*.map', { cwd: buildPath });
+  const mapFiles = globSync('**/*.map', { cwd: buildPath });
 
   mapFiles.forEach(file => {
     fs.unlinkSync(path.join(buildPath, file));