[iLevyTate]

Summary

• glob (Dependabot, moderate): GHSA-3g3m-2fjr-6pw4. glob >=9.0.0 <=14.0.1 keeps walking directories after its AbortSignal fires; the first patched release is 14.0.2. Every affected copy is dev-only: jest-config, jest-runtime and @jest/reporters (13.0.6), rimraf (13.0.6) and test-exclude (10.5.0).
• A scoped override, "glob@>=9.0.0 <14.0.2": "^14.0.2", moves exactly those copies to 14.0.3. glob 10, 13 and 14 export the same API, including the glob.sync that test-exclude calls. @electron/asar keeps its glob 7.2.3, which is outside the advisory and has a different, callback-based API.
• docs/commercial-use-inventory.json is regenerated for the lockfile change and is stable on re-run.
• deepmerge (Dependabot, low), not changed: GHSA-gcqx-w48m-w2h4 lists no patched version; the latest release, 4.3.1, is the top of the vulnerable range. It is dev-only, and its two users, jest-config and @svgr/plugin-svgo, merge config objects from this repo, not attacker input. That alert has to be dismissed in GitHub; this session can't read or dismiss Dependabot alerts.

Scope

• Area(s): dev dependencies (jest, rimraf, coverage tooling)
• Risk Level: low. Dev-only and same API. The full npm run ci exercises every affected consumer: jest config, runtime and coverage, test-exclude instrumentation, and rimraf in build.
• Breaking Changes: none

Type of Change

• Bug fix
• Enhancement
• New feature
• Refactor
• Documentation update
• Breaking change

Test Plan

Automated

• npm run format:check
• npm run lint
• npm test
• Additional tests added/updated when behavior changed

npm audit no longer reports GHSA-3g3m-2fjr-6pw4, and npm audit --omit=dev finds 0 vulnerabilities. compliance:commercial:verify passes. The full npm run ci is running locally on this commit; I'll report the result here before merging.

Manual QA

• Manual checklist completed (see docs/TESTING.md)
• Not applicable (explain below)

Manual QA notes:

• Only dev tooling changes, and nothing ships in the app.

Checklist

• I scoped this PR to one logical change
• I self-reviewed code and naming for clarity
• I updated docs/config references where needed
• I called out follow-up work or known limitations: dismiss the deepmerge alert (no fix exists). npm audit also still lists GHSA-g3hv-75wg-m249 for nested dev copies of minimatch 3.x/5.x/9.x. Their callers (eslint, jest, electron-builder) need those majors, and 3.x callers use the module as a function, which 11 no longer exports.

---

Generated by Claude Code