[iLevyTate]

Summary

• GHSA-g3hv-75wg-m249 (moderate): minimatch <11.0.1 can amplify globparts in firstPhasePreProcess() when optimizationLevel >= 2. The only fix is 11.0.1; there are no backports. That code exists in 9.x and 10.x, used here by eslint, @eslint/config-array, @typescript-eslint/typescript-estree, app-builder-lib, @electron/universal and test-exclude.
• A range-keyed override, "minimatch@>=9.0.0 <11.0.1": "^11.0.3", moves those six copies to the project's minimatch 11.0.3, and they deduplicate to the root copy. With the range key alone, npm kept re-adding 10.2.6 under test-exclude and flagging it invalid, so test-exclude also gets a nested override. Its subtree holds only glob 14 and minimatch 11.
• API check: 11 drops the top-level makeRe/AST exports and Minimatch#makeRe. None of the six consumers uses them. They call minimatch(), new Minimatch(), .match(path, partial), .negate and .set.
• Left as is: the seven 3.x/5.x copies, used by eslint-plugin-import/react/jsx-a11y, @electron/asar and its glob 7, dir-compare and filelist. They have no firstPhasePreProcess or optimizationLevel, so the vulnerable code isn't there. Their callers also use the module as a function, which 11 no longer exports, and @electron/asar matches the asar unpack patterns. npm audit still lists them, because the advisory's single range covers every major.

Scope

• Area(s): dev dependencies (ESLint, electron-builder, jest coverage)
• Risk Level: medium. electron-builder's file matching runs on the new minimatch, so the checks below compare the real outputs.
• Breaking Changes: none

Type of Change

• Bug fix
• Enhancement
• New feature
• Refactor
• Documentation update
• Breaking change

Test Plan

Automated

• npm run format:check
• npm run lint
• npm test
• Additional tests added/updated when behavior changed

Before/after comparisons on the real tree:

• electron-builder matching: for all six release legs, over about 57,000 files, its matchers (getMainFileMatchers and getNodeModuleFileMatcher with the committed configs) select identical files with minimatch 10.2.6 and 11.0.3. The only differences are the removed minimatch copies themselves.
• ESLint: it lints the same 1,546 files with identical results (0 errors, 2 warnings) on main and on this branch.
• Audit and lockfile: npm audit --omit=dev finds 0 vulnerabilities. A second npm install leaves the lockfile unchanged, npm ci --dry-run (with the repo's .npmrc) passes, and npm ls shows no invalid minimatch nodes.
• Pending: the full npm run ci is running locally. I'll compare its coverage totals with main's before merging.

Manual QA

• Manual checklist completed (see docs/TESTING.md)
• Not applicable (explain below)

Manual QA notes:

• Only dev and build tooling changes. The packaged-file comparison and the release workflows' app.asar check cover the electron-builder side.

Checklist

• I scoped this PR to one logical change
• I self-reviewed code and naming for clarity
• I updated docs/config references where needed
• I called out follow-up work or known limitations: the 3.x/5.x copies stay in npm audit until their parents move to minimatch 9+. The newer filelist 2.x and @electron/asar 4.x already have, but they sit behind jake and electron-builder's pinned @electron/asar 3.4.1.

---

Generated by Claude Code