[agentHits]

bun audit --audit-level=moderate in "audit and typecheck" now fails
on every PR into AgentHits-Dev, including the daily deps/auto-update,
with two moderate advisories in development and transitive packages:

• glob 13.0.6 and 10.5.0, GHSA-3g3m-2fjr-6pw4: an aborted AbortSignal
  does not stop the walk, so the filesystem traversal continues after a
  timeout. Affected >=9.0.0 <=14.0.1, fixed in 14.0.2.
• minimatch 10.2.6 and 9.0.9, GHSA-g3hv-75wg-m249: a crafted pattern
  amplifies the glob parts it expands into (denial of service).
  Affected <11.0.1, fixed in 11.0.1.

Only the new majors carry the fixes, no 10.x or 13.x backport exists, so
bun update within the declared ranges cannot reach them: rimraf 6.1.3
asks for glob ^13.0.3, rimraf 5.0.10 (via inngest > OpenTelemetry >
gcp-metadata > gaxios) for glob ^10.3.7, @ts-morph/common (via shadcn)
and @swagger-api/apidom-reference (via swagger-ui-react) for minimatch
^10. Two root overrides in the usual range form lift them:
"glob": ">=14.0.2 <15.0.0" and "minimatch": ">=11.0.1 <12.0.0".
They resolve to glob 14.0.3 and minimatch 11.0.3 (released 2026-10-28,
older than the one-day release age). The lockfile changes only glob,
minimatch and path-scurry 3.0.0; the separate glob 10 tree under gaxios
and its cliui/jackspeak helpers are gone.

Compatibility with the new majors:

• glob 14 exports the same API as 10 and 13 (CommonJS and ESM).
  rimraf 5 and 6 import only glob/globSync; both delete by pattern and
  by path on glob 14, and the rimraf CLI of the build scripts
  (rimraf dist) works. gaxios declares rimraf but never loads it.
• minimatch 11 drops the top-level makeRe and AST exports. Its two
  outside users call only minimatch(): ts-morph's file globbing (shadcn
  CLI) and apidom-reference's file resolver, both checked on 11.0.3.

The overrides can go once rimraf, gaxios, @ts-morph/common and
@swagger-api/apidom-reference require the fixed versions themselves.
deepmerge 4.3.1 keeps a low advisory (GHSA-gcqx-w48m-w2h4) below the
moderate threshold; no fixed release exists yet.

Checks: bun audit --audit-level=moderate reports no vulnerabilities;
bun install --frozen-lockfile; bun run server:build; bun run build;
bun run typecheck. Locally bun run test passed 4285 of 4294 tests; the
4 failures are the real Docker builds in application.real.test.ts,
which could not reach github.com and docker.io from the build
containers on this machine, so the CI test job is the reference.

After the merge, rerun the checks of #133 and #130: they fail only on this audit.

🤖 Generated with Claude Code