feat: upgrade minimatch to v10.0.3

[robdefeo]

Summary

This PR upgrades the minimatch dependency from ~3.0.3 to 10.0.3 across the entire Rush monorepo to address a Regular Expression Denial of Service (ReDoS) vulnerability in the underlying brace-expansion dependency.

🔒 Security Issue
Vulnerability: GHSA-v6h2-p8h4-qcjw - CVE-2025-5889
Severity: Low (CVSS 1.3/10)
Impact: ReDoS vulnerability in brace-expansion dependency used by older versions of minimatch

The vulnerability affects the brace-expansion package versions:

= 2.0.0, <= 2.0.1
= 1.0.0, <= 1.1.11
= 3.0.0
= 4.0.0
While the severity is rated as low, upgrading eliminates this attack vector entirely.

Details

Dependency Updates

• minimatch: ~3.0.3 → 10.0.3
• @types/minimatch: 3.0.5 → 6.0.0

API Breaking Changes Fixed

Minimatch v10 introduced breaking changes in its export structure. Updated import statements:

Before (v3):

import minimatch from 'minimatch';

After (v10):

import { minimatch } from 'minimatch';

Files Updated

• Collector.ts - Fixed import statement
• WebpackConfigurationUpdater.ts - Fixed import statement
• Multiple package.json files across the monorepo
  Lock files and repo state hashes updated

Configuration Management

• Added minimatch: "10.0.3" and @types/minimatch: "6.0.0" to common-versions.json preferredVersions
• Used Rush's automated dependency management via rush add commands
• Ensured consistent versions across all projects

How it was tested

• rush check - No dependency mismatches
• rush build - All packages build successfully
• rush test - All tests pass
• Verified API compatibility fixes work correctly

[robdefeo]

@robdefeo please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Vidos Ltd"

[robdefeo]

@robdefeo the command you issued was incorrect. Please try again.

Examples are:

@microsoft-github-policy-service agree

and

@microsoft-github-policy-service agree company="your company"

@microsoft-github-policy-service agree company="Vidos Ltd"

[dmichon-msft]

We don't need @types/minimatch at all anymore, but otherwise this looks fine.