chore(deps-dev): bump glob from 7.2.3 to 13.0.6

[dependabot]

Bumps glob from 7.2.3 to 13.0.6.

Changelog

Sourced from glob's changelog.

changeglob

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

• Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
• Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
• Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

• Drop support for node before v20

10.4

• Add includeChildMatches: false option
• Export the Ignore class

10.3

• Add --default -p flag to provide a default pattern
• exclude symbolic links to directories when follow and nodir are both set

10.2

• Add glob cli

10.1

• Return '.' instead of the empty string '' when the current working directory is returned as a match.
• Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

• e80cb38 13.0.6
• 9cdbbff revert tsgo, not ready for test coverage correctness yet
• 89c99ba use tsgo compiler
• b7275d5 update deps, expand engines to include node 18
• 942e360 update workflows, pull taprc out of package.json
• 4a0d53c update tap for mockImport bugfix
• ef94ad2 update tap
• 180c2d4 update docs
• 37993c8 remove stray console.error in test
• 03ae4c2 13.0.5
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Approved: the glob 13 migration is scoped to dependency metadata and the required test-discovery API/order compatibility changes, with all checks passing.

[Copilot]

🟡 Changes recommended

The lockfile still introduces glob@7.2.3 transitively (via rimraf@3), which remains deprecated/vulnerable and undercuts the security posture of the glob bump.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the dev dependency on glob to a new major version and adjusts the Mocha test entrypoints to use the newer promise-based/named-export API so test discovery continues to work under the upgraded glob.

Changes:

• Bump glob devDependency from ^7.2.3 to ^13.0.6.
• Update test suite entrypoints to import glob as a named export and await the promise API.
• Regenerate lockfile to reflect new dependency graph for glob@13.

File summaries

File	Description
test/unmanaged-folder-suite/index.ts	Switches to glob named export + async/await-based file discovery.
test/suite/index.ts	Switches to glob named export + async/await-based file discovery.
package.json	Updates glob devDependency to ^13.0.6.
package-lock.json	Updates resolved dependency tree for glob@13 and related transitive deps.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Changyong Gong (chagong)]

Approved: the current head completes the glob 13 API and deterministic-order migration, replaces stale @types/glob with the directly used @types/minimatch, resolves the review thread, and has all checks passing.

[Copilot]

🟡 Changes recommended

The lockfile still introduces glob@7.2.3 transitively (via rimraf@3), which is explicitly deprecated for security vulnerabilities and likely defeats the intent of the bump for security scanning.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Changyong Gong (chagong)]

Approved: the current head keeps the required test-discovery dependency, completes the glob 13 compatibility migration, and passes the full validation and CI gates.

[Changyong Gong (chagong)]

Approved: the final head completes the glob 13 migration, declares the existing minimatch production import as a direct runtime dependency, and passes clean install, build, packaging, integration tests, and all CI checks.

[Copilot]

🟡 Changes recommended

The lockfile still includes glob@7.2.3 via rimraf@3, which undermines the intent of bumping away from deprecated/vulnerable glob versions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Changyong Gong (chagong)]

Approved: the current head retains only directly required dependencies, completes the glob 13 compatibility migration, and has successful compile, lint, package, and CI results.