chore(deps): resolve minimatch and glob audit advisories (WealthLedger/main#49) (#128)

.dockerignore

@@ -13,6 +13,9 @@
 !public/**
 !docker/
 !docker/**
+!scripts/
+!scripts/minimatch-compat/
+!scripts/minimatch-compat/**
 !packages/
 !packages/tokens/
 !packages/tokens/package.json

Dockerfile

@@ -5,6 +5,7 @@ COPY package.json package-lock.json ./
 COPY packages/tokens/package.json ./packages/tokens/
 COPY packages/ui/package.json ./packages/ui/
 COPY packages/icons/package.json ./packages/icons/
+COPY scripts/minimatch-compat ./scripts/minimatch-compat
 RUN npm ci
 
 FROM dependencies AS development

knip.json

@@ -1,5 +1,5 @@
 {
-	"ignoreDependencies": ["conventional-changelog-conventionalcommits"],
+	"ignoreDependencies": ["conventional-changelog-conventionalcommits", "minimatch"],
 	"workspaces": {
 		".": {
 			"project": ["src/**/*.{ts,tsx}", "!src/shared/api/generated/**"]

package-lock.json

@@ -80,6 +80,7 @@
 				"jsdom": "30.1.3",
 				"knip": "6.43.0",
 				"lint-staged": "17.6.0",
+				"minimatch": "file:scripts/minimatch-compat",
 				"msw": "2.15.0",
 				"openapi-typescript": "7.13.0",
 				"playwright": "1.64.1",
@@ -88,7 +89,7 @@
 				"typescript": "5.9.3",
 				"typescript-eslint": "8.72.0",
 				"vite": "8.3.5",
-				"vite-plugin-pwa": "1.3.0",
+				"vite-plugin-pwa": "2.0.0",
 				"vitest": "5.0.5"
 			},
 			"engines": {
@@ -2511,14 +2512,12 @@
 				}
 			}
 		},
-		"node_modules/@isaacs/cliui": {
+		"node_modules/@isaacs/nonrecursive-glob-match": {
-			"version": "9.0.0",
+			"version": "1.0.3",
-			"integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==",
+			"resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz",
+			"integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==",
 			"dev": true,
-			"license": "BlueOak-1.0.0",
+			"license": "BlueOak-1.0.0"
-			"engines": {
-				"node": ">=18"
-			}
 		},
 		"node_modules/@joshwooding/vite-plugin-react-docgen-typescript": {
 			"version": "0.7.0",
@@ -3720,33 +3719,6 @@
 				"npm": ">=9.5.0"
 			}
 		},
-		"node_modules/@redocly/openapi-core/node_modules/balanced-match": {
-			"version": "1.0.2",
-			"integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-			"dev": true,
-			"license": "MIT"
-		},
-		"node_modules/@redocly/openapi-core/node_modules/brace-expansion": {
-			"version": "2.1.7",
-			"integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"balanced-match": "^1.0.0"
-			}
-		},
-		"node_modules/@redocly/openapi-core/node_modules/minimatch": {
-			"version": "5.1.9",
-			"integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
-			"dev": true,
-			"license": "ISC",
-			"dependencies": {
-				"brace-expansion": "^2.0.1"
-			},
-			"engines": {
-				"node": ">=10"
-			}
-		},
 		"node_modules/@reduxjs/toolkit": {
 			"version": "2.12.0",
 			"integrity": "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==",
@@ -6448,6 +6420,7 @@
 		},
 		"node_modules/balanced-match": {
 			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
 			"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
 			"dev": true,
 			"license": "MIT",
@@ -6495,6 +6468,7 @@
 		},
 		"node_modules/brace-expansion": {
 			"version": "5.0.12",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
 			"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
 			"dev": true,
 			"license": "MIT",
@@ -9097,33 +9071,6 @@
 				"minimatch": "^5.0.1"
 			}
 		},
-		"node_modules/filelist/node_modules/balanced-match": {
-			"version": "1.0.2",
-			"integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-			"dev": true,
-			"license": "MIT"
-		},
-		"node_modules/filelist/node_modules/brace-expansion": {
-			"version": "2.1.7",
-			"integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"balanced-match": "^1.0.0"
-			}
-		},
-		"node_modules/filelist/node_modules/minimatch": {
-			"version": "5.1.9",
-			"integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
-			"dev": true,
-			"license": "ISC",
-			"dependencies": {
-				"brace-expansion": "^2.0.1"
-			},
-			"engines": {
-				"node": ">=10"
-			}
-		},
 		"node_modules/find-up": {
 			"version": "5.0.0",
 			"integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
@@ -9194,22 +9141,6 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
-		"node_modules/foreground-child": {
-			"version": "3.3.1",
-			"integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-			"dev": true,
-			"license": "ISC",
-			"dependencies": {
-				"cross-spawn": "^7.0.6",
-				"signal-exit": "^4.0.1"
-			},
-			"engines": {
-				"node": ">=14"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/isaacs"
-			}
-		},
 		"node_modules/formatly": {
 			"version": "0.11.4",
 			"resolved": "https://registry.npmjs.org/formatly/-/formatly-0.11.4.tgz",
@@ -9488,14 +9419,15 @@
 			}
 		},
 		"node_modules/glob": {
-			"version": "13.0.6",
+			"version": "14.0.3",
-			"integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+			"resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
+			"integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
-				"minimatch": "^10.2.2",
+				"minimatch": "^11.0.2",
 				"minipass": "^7.1.3",
-				"path-scurry": "^2.0.2"
+				"path-scurry": "^3.0.0"
 			},
 			"engines": {
 				"node": "18 || 20 || >=22"
@@ -10670,21 +10602,6 @@
 				"node": "^18.17 || >=20.6.1"
 			}
 		},
-		"node_modules/jackspeak": {
-			"version": "4.2.3",
-			"integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==",
-			"dev": true,
-			"license": "BlueOak-1.0.0",
-			"dependencies": {
-				"@isaacs/cliui": "^9.0.0"
-			},
-			"engines": {
-				"node": "20 || >=22"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/isaacs"
-			}
-		},
 		"node_modules/jake": {
 			"version": "10.9.4",
 			"integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==",
@@ -11473,12 +11390,19 @@
 			}
 		},
 		"node_modules/minimatch": {
-			"version": "10.2.6",
+			"resolved": "scripts/minimatch-compat",
-			"integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+			"link": true
+		},
+		"node_modules/minimatch-11": {
+			"name": "minimatch",
+			"version": "11.0.2",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
+			"integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
-				"brace-expansion": "^5.0.8"
+				"@isaacs/nonrecursive-glob-match": "^1.0.2",
+				"brace-expansion": "^5.0.12"
 			},
 			"engines": {
 				"node": "18 || 20 || >=22"
@@ -12212,12 +12136,6 @@
 				"quickjs-wasi": "^2.2.0"
 			}
 		},
-		"node_modules/package-json-from-dist": {
-			"version": "1.0.1",
-			"integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-			"dev": true,
-			"license": "BlueOak-1.0.0"
-		},
 		"node_modules/package-manager-detector": {
 			"version": "1.9.0",
 			"resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.9.0.tgz",
@@ -12314,8 +12232,9 @@
 			"license": "MIT"
 		},
 		"node_modules/path-scurry": {
-			"version": "2.0.2",
+			"version": "3.0.0",
-			"integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+			"resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+			"integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
@@ -15929,8 +15848,9 @@
 			}
 		},
 		"node_modules/vite-plugin-pwa": {
-			"version": "1.3.0",
+			"version": "2.0.0",
-			"integrity": "sha512-c5kMgN+ITrOtHXp8PAtk2uOIEea6XjP/unCGxOWWBzQ6qa65qj/awHg0wf+QF9E/2u9vh86LqxPwzEPNbM2r5A==",
+			"resolved": "https://registry.npmjs.org/vite-plugin-pwa/-/vite-plugin-pwa-2.0.0.tgz",
+			"integrity": "sha512-6G9dsPKT9QKYpeTuTLJM28zZL3HsXUTUM/QUZBEgQk2jbfrPJDq2i8gTewAKqi1c9Mt6MiidrL4SFI+HthiQMg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -15941,13 +15861,13 @@
 				"workbox-window": "^7.4.1"
 			},
 			"engines": {
-				"node": ">=16.0.0"
+				"node": ">=20.19.0"
 			},
 			"funding": {
 				"url": "https://github.com/sponsors/antfu"
 			},
 			"peerDependencies": {
-				"@vite-pwa/assets-generator": "^1.0.0",
+				"@vite-pwa/assets-generator": "^1.0.0 || ^2.0.0",
 				"vite": "^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0",
 				"workbox-build": "^7.4.1",
 				"workbox-window": "^7.4.1"
@@ -17642,30 +17562,6 @@
 				"@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
 			}
 		},
-		"node_modules/workbox-build/node_modules/glob": {
-			"version": "11.1.0",
-			"integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==",
-			"deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
-			"dev": true,
-			"license": "BlueOak-1.0.0",
-			"dependencies": {
-				"foreground-child": "^3.3.1",
-				"jackspeak": "^4.1.1",
-				"minimatch": "^10.1.1",
-				"minipass": "^7.1.2",
-				"package-json-from-dist": "^1.0.0",
-				"path-scurry": "^2.0.0"
-			},
-			"bin": {
-				"glob": "dist/esm/bin.mjs"
-			},
-			"engines": {
-				"node": "20 || >=22"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/isaacs"
-			}
-		},
 		"node_modules/workbox-build/node_modules/lru-cache": {
 			"version": "5.1.1",
 			"integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
@@ -18076,6 +17972,14 @@
 				"react": "19.3.1",
 				"react-dom": "19.3.1"
 			}
+		},
+		"scripts/minimatch-compat": {
+			"name": "minimatch",
+			"version": "11.0.2-compat.0",
+			"dev": true,
+			"dependencies": {
+				"minimatch-11": "npm:minimatch@11.0.2"
+			}
 		}
 	}
 }

package.json

@@ -106,6 +106,7 @@
 		"jsdom": "30.1.3",
 		"knip": "6.43.0",
 		"lint-staged": "17.6.0",
+		"minimatch": "file:scripts/minimatch-compat",
 		"msw": "2.15.0",
 		"openapi-typescript": "7.13.0",
 		"playwright": "1.64.1",
@@ -114,7 +115,7 @@
 		"typescript": "5.9.3",
 		"typescript-eslint": "8.72.0",
 		"vite": "8.3.5",
-		"vite-plugin-pwa": "1.3.0",
+		"vite-plugin-pwa": "2.0.0",
 		"vitest": "5.0.5"
 	},
 	"overrides": {
@@ -124,7 +125,9 @@
 		},
 		"@vitest/browser": "5.0.5",
 		"@vitest/ui": "5.0.5",
-		"@vitest/mocker": "5.0.5"
+		"@vitest/mocker": "5.0.5",
+		"minimatch": "$minimatch",
+		"glob": "14.0.3"
 	},
 	"allowScripts": {
 		"esbuild@0.28.2": true,

scripts/minimatch-compat/index.cjs

@@ -0,0 +1,9 @@
+// ponytail: CommonJS twin of index.js (import-x ships lib/index.cjs too).
+const minimatch = require("minimatch-11");
+
+module.exports = {
+	...minimatch,
+	makeRe: (pattern, options = {}) => ({
+		test: path => minimatch.minimatch(path, pattern, options),
+	}),
+};

scripts/minimatch-compat/index.js

@@ -0,0 +1,11 @@
+// ponytail: shim for eslint-plugin-import-x@4.17.1, which still imports the
+// makeRe export removed in minimatch 11. Its only caller (no-internal-modules)
+// uses the result via .test(), so a matcher object is enough. Delete this
+// package and the override once import-x supports minimatch 11.
+import { minimatch } from "minimatch-11";
+
+export * from "minimatch-11";
+
+export const makeRe = (pattern, options = {}) => ({
+	test: path => minimatch(path, pattern, options),
+});

scripts/minimatch-compat/package.json

@@ -0,0 +1,14 @@
+{
+	"name": "minimatch",
+	"version": "11.0.2-compat.0",
+	"private": true,
+	"description": "minimatch 11 plus the makeRe export eslint-plugin-import-x 4.17.1 still imports. Remove when import-x supports minimatch 11.",
+	"type": "module",
+	"exports": {
+		"import": "./index.js",
+		"require": "./index.cjs"
+	},
+	"dependencies": {
+		"minimatch-11": "npm:minimatch@11.0.2"
+	}
+}