Skip to content

chore(deps): upgrade glob to v13 - #1805

Closed
pereorga wants to merge 1 commit into
htmlhint:mainfrom
pereorga:chore/update-glob
Closed

chore(deps): upgrade glob to v13#1805
pereorga wants to merge 1 commit into
htmlhint:mainfrom
pereorga:chore/update-glob

Conversation

@pereorga

@pereorga pereorga commented Feb 17, 2026

Copy link
Copy Markdown

glob@9 is deprecated with published security vulnerabilities. Upgrading to v13 (latest).

@pereorga
pereorga requested a review from coliff as a code owner February 17, 2026 17:54

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly upgrades the glob dependency to version 13 to address security vulnerabilities and updates the Node.js engine requirement to 20 || >=22, dropping support for Node 18 as stated. The changes in package.json and package-lock.json are consistent and reflect these updates. I have one suggestion regarding dependency pinning to enhance the stability of the project.

Comment thread package.json Outdated
@coliff coliff mentioned this pull request Feb 18, 2026
9 tasks
@pereorga pereorga changed the title chore(deps): upgrade glob to v13, drop Node 18 support chore(deps): upgrade glob to v13 Feb 20, 2026
@coliff
coliff requested a review from Copilot February 20, 2026 06:53

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades the glob dependency from v9.0.0 to v13.0.6 to address deprecated status and published security vulnerabilities in glob v9.

Changes:

  • Upgraded glob from ^9.0.0 to ^13.0.6 in package.json
  • Updated package-lock.json with new dependency tree for glob v13 and its transitive dependencies
  • Node engine requirement changed from ">=18" to "20 || >=22" in package-lock.json

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Updated glob dependency version from ^9.0.0 to ^13.0.6
package-lock.json Updated lock file with glob v13 dependency tree, including updated versions of minimatch (v10.2.2), minipass (v7.1.3), path-scurry (v2.0.2), and their nested dependencies; removed @isaacs/balanced-match and @isaacs/brace-expansion dev dependencies; marked balanced-match and fs.realpath as dev dependencies; Node engine requirement changed to "20

@coliff

coliff commented Mar 5, 2026

Copy link
Copy Markdown
Member

thanks for the PR - addresses in a separate one - will get a 1.9.2 release out soon with this fix!

@coliff coliff closed this Mar 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants