fix: override minimatch to resolve high-severity ReDoS advisories

Pin transitive minimatch to >=9.0.7 via pnpm overrides so CI pnpm audit passes on the @n8n/node-cli eslint toolchain path.

Author: redanthrax

SECURITY.md

@@ -13,7 +13,7 @@ This repository uses defenses against npm supply-chain worms such as **Mini Shai
 - **Blocklist scan** — `pnpm run audit:supply-chain` checks the lockfile against `security/compromised-packages.json` and validates pnpm config.
 - **Delayed updates** — `minimumReleaseAge` (24h, strict) reduces exposure to freshly published malicious versions.
 - **No exotic transitive deps** — `blockExoticSubdeps` blocks git/tarball transitive resolutions.
-- **Version overrides** — known CVEs are mitigated via `overrides` in `pnpm-workspace.yaml` (e.g. `lodash`, `uuid`).
+- **Version overrides** — known CVEs are mitigated via `overrides` in `pnpm-workspace.yaml` (e.g. `lodash`, `uuid`, `minimatch`).
 
 ### Enforcing pnpm for contributors
 

pnpm-lock.yaml

@@ -5,6 +5,7 @@ packages:
 overrides:
   lodash: '>=4.18.0'
   uuid: '11.1.1'
+  minimatch: '>=9.0.7'
   # npm dist-tag stable; block 2.23+ beta-channel releases
   n8n-workflow: '2.22.3'