[patch-agent] Security fix: Update glob (CVE-2025-64756)

[trm-github-service-account]

Security Vulnerability Fix

🔒 Vulnerability Summary

CVE ID: CVE-2025-64756
Severity: High
Package: glob
CVSS Score: Not yet published in NVD database (CVE is from 2025)

Description

A security vulnerability has been identified in the glob package version 11.0.1 and earlier within the v11 release line. The glob package is a widely-used library for matching files using glob patterns, commonly used in build tools and file system operations. This vulnerability affects applications that use glob for file path matching and could potentially allow attackers to exploit pattern matching behavior.

The specific technical details of CVE-2025-64756 have not been fully published in public databases yet, as this is a very recent vulnerability disclosure. However, the maintainers have released version 11.1.0 to address this security issue.

---

🔄 Changes Made

Dependency Update

• Package: glob
• Previous Version: 11.0.1
• Wiz Recommended Version: 11.1.0
• Actual Version Applied: 11.1.0
• Update Type: Minor version update (security patch)

Version Selection Rationale

Version 11.1.0 was chosen because:

• It is the minimum version recommended by Wiz security scanning that addresses CVE-2025-64756
• It is the latest available version in the v11 major release line
• It represents a minor version bump (11.0.1 → 11.1.0) which minimizes the risk of breaking changes
• Staying within the same major version (v11) ensures compatibility with the existing codebase

Files Modified

• /package.json - Added resolutions field to force glob version to 11.1.0
• /yarn.lock - Updated lock file with new glob version and its dependencies

Implementation Details

Since glob is a transitive dependency (used by rimraf in devDependencies), we used Yarn's resolutions feature to force all instances of glob to use version 11.1.0. This approach ensures:

• The vulnerability is fixed across all dependency paths
• Minimal changes to package.json (no new direct dependencies added)
• Clean lock file updates with only necessary changes

---

🛡️ Security Impact

What This Fixes

This update addresses a security vulnerability in the glob package (CVE-2025-64756). While the full technical details are still being published, updating to version 11.1.0 ensures our application is protected against this identified vulnerability.

Breaking Changes

• This update includes breaking changes
• This is a backward-compatible security patch

Based on semantic versioning, this minor version update (11.0.1 → 11.1.0) should not introduce breaking changes. The glob package typically reserves breaking changes for major version updates.

Affected Components

The glob package is used as a transitive dependency through:

• rimraf (devDependency v6.0.1) - Used in the build script for cleaning the dist directory
• Impact is limited to development and build processes
• No runtime dependencies are affected

The package is used in the build pipeline via the npm script:

"build": "rimraf dist && rollup -c"

---

✅ Validation

Automated Checks

• Dependency version updated in package.json (via resolutions)
• Lock file regenerated successfully
• Yarn resolved dependencies without conflicts

Compatibility Assessment

• Version 11.1.0 is a minor update within the same major version
• No API changes or deprecations expected for minor version updates
• Build scripts should continue to function without modification

---

📚 References

• CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64756
• Package Repository: https://github.com/isaacs/node-glob
• Package Changelog: https://github.com/isaacs/node-glob/releases
• GitHub Security Advisory: https://github.com/trmlabs/force-graph/security/dependabot/5
• JIRA Ticket: patch-agent

---

🤖 Automation Note

This PR was automatically generated by PATCH (Proactive Autonomous Threat Correction Handler).
For questions or issues, please contact the Security or DevOps team.

---

📋 Reviewer Checklist

• Verified the CVE details and severity assessment
• Reviewed the yarn.lock changes for unexpected modifications
• Confirmed the updated version resolves the vulnerability
• Checked that build scripts still function correctly
• Approved for merge to master branch