Possible fix(deps): 12 vulnerable dependencies in package-lock.json

[begininvoke]

This might be a false positive, but package-lock.json around line 2800 looked worth a second pair of eyes.

The project depends on glob v10.4.3, which contains a command‑injection flaw in the CLI’s –c/--cmd option. Filenames that include shell metacharacters are passed to exec with shell: true, allowing an attacker controlling a file name (e.g., via a malicious artifact or pull‑request) to execute arbitrary commands with the privileges of the running process (often CI or build‑agent user). This is a HIGH‑severity vulnerability because it can lead to full compromise of the build environment and downstream systems.

Something like this might fix it:

*** Begin Patch
*** Update File: package-lock.json
@@
-        "name": "glob",
-        "version": "10.4.3",
+        "name": "glob",
+        "version": "10.5.0",
*** End Patch

*** Begin Patch
*** Update File: package.json
@@
-    "glob": "^10.4.3",
+    "glob": "^10.5.0",
*** End Patch

After applying the diff, run `npm install` (or `npm ci`) to rewrite the lockfile and fetch the patched version. Upgrading to glob >=10.5.0 (or 11.1.0) eliminates the vulnerable CLI path and removes the command‑injection risk.

For reference: rule CVE-2025-64756. Rated high.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.