Skip to content

Upgrade glob to v13 - #76

Merged
arvida merged 1 commit into
mainfrom
fix/glob-13
Sep 15, 2026
Merged

arvida merged 1 commit into
mainfrom
fix/glob-13

Conversation

@arvida

@arvida arvida commented Sep 15, 2026

Copy link
Copy Markdown
Contributor
  • glob 10.5.0 is deprecated (legacy-v10) and printed a deprecation warning on every npx install
  • Clears 2 high-severity advisories in production deps: minimatch ReDoS (9.0.0-9.0.6) and brace-expansion DoS
  • v13 is the only major that keeps Node 18 support (engines 18 || 20 || >=22); v11 and v12 require 20 || >=22
  • Drops 3 transitive deps: jackspeak, foreground-child, package-json-from-dist
  • No code changes: glob() still returns Promise<string[]> without withFileTypes, and ignore/absolute/follow are unchanged

- glob 10.5.0 is deprecated (legacy-v10) and printed a deprecation
  warning on every npx install
- Clears 2 high-severity advisories in production deps: minimatch
  ReDoS (9.0.0-9.0.6) and brace-expansion DoS
- v13 is the only major that keeps Node 18 support (engines
  18 || 20 || >=22); v11 and v12 require 20 || >=22
- Drops 3 transitive deps: jackspeak, foreground-child,
  package-json-from-dist
- No code changes: glob() still returns Promise<string[]> without
  withFileTypes, and ignore/absolute/follow are unchanged

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@arvida
arvida merged commit ff6620e into main Sep 15, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant