[vorobey]

Fixed (override):

• minimatch GHSA-g3hv-75wg-m249: added minimatch@<11.0.1: ^11.0.1 to pnpm-workspace.yaml overrides (resolves 11.0.4).

The fix exists only in minimatch 11 (no 10.x backport, isaacs/minimatch#333), while eslint, @eslint/config-array and typescript-eslint still declare minimatch: ^10, so this forces a new major. They only use new Minimatch(...) / .match(), which minimatch 11 keeps. The override can be removed once eslint/eslint#21463 and typescript-eslint/typescript-eslint#13125 land.

Checked: pnpm audit clean, pnpm run lint and pnpm run build pass, pnpm peers check unchanged.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

There are no active review issues with the minimatch security override and corresponding lockfile update.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Addresses minimatch advisory GHSA-g3hv-75wg-m249 by overriding vulnerable versions used by the linting dependencies.

Changes:

• Forces minimatch versions below 11.0.1 onto the 11.x release line.
• Updates the lockfile to minimatch 11.0.4 and adds its new transitive dependency.

File	Description
pnpm-workspace.yaml	Adds the security override for minimatch.
pnpm-lock.yaml	Records the override and updated dependency resolutions.

_{Review effort: Balanced}