From ea3f335679e20ceea6d5dfbf0b7423376f2eae06 Mon Sep 17 00:00:00 2001
From: Antonis Lilis <antonis.lilis@sentry.io>
Date: Tue, 21 Jul 2026 13:03:15 +0200
Subject: [PATCH] chore(deps): pin glob 10.x resolution to ^10.5.0 to resolve
 command-injection advisory

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 package.json | 7 ++++++-
 yarn.lock    | 8 ++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index ac2ddf9c82..03fe3bca2a 100644
--- a/package.json
+++ b/package.json
@@ -93,12 +93,17 @@
     "@tufjs/models@npm:2.0.1/minimatch": "^9.0.7",
     "@typescript-eslint/typescript-estree@npm:6.21.0/minimatch": "^9.0.7",
     "editorconfig@npm:1.0.4/minimatch": "^9.0.7",
-    "glob@npm:10.4.5/minimatch": "^9.0.7",
+    "glob@npm:10.5.0/minimatch": "^9.0.7",
     "ignore-walk@npm:6.0.5/minimatch": "^9.0.7",
     "npm-run-all2@npm:6.2.2/minimatch": "^9.0.7",
     "nx@npm:19.6.4/minimatch": "^9.0.7",
     "webdriverio@npm:8.40.5/minimatch": "^9.0.7",
     "glob@npm:13.0.0/minimatch": "^10.2.3",
+    "glob@npm:^10.0.0": "^10.5.0",
+    "glob@npm:^10.2.2": "^10.5.0",
+    "glob@npm:^10.3.3": "^10.5.0",
+    "glob@npm:^10.3.10": "^10.5.0",
+    "glob@npm:^10.4.2": "^10.5.0",
     "axios": "^1.18.1",
     "fast-xml-parser": "^5.7.0",
     "form-data": "4.0.6",
diff --git a/yarn.lock b/yarn.lock
index 7ff0ef639a..f9995c8df8 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -18042,9 +18042,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:^10.0.0, glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.3.3, glob@npm:^10.4.2":
-  version: 10.4.5
-  resolution: "glob@npm:10.4.5"
+"glob@npm:^10.5.0":
+  version: 10.5.0
+  resolution: "glob@npm:10.5.0"
   dependencies:
     foreground-child: "npm:^3.1.0"
     jackspeak: "npm:^3.1.2"
@@ -18054,7 +18054,7 @@ __metadata:
     path-scurry: "npm:^1.11.1"
   bin:
     glob: dist/esm/bin.mjs
-  checksum: 10c0/19a9759ea77b8e3ca0a43c2f07ecddc2ad46216b786bb8f993c445aee80d345925a21e5280c7b7c6c59e860a0154b84e4b2b60321fea92cd3c56b4a7489f160e
+  checksum: 10c0/100705eddbde6323e7b35e1d1ac28bcb58322095bd8e63a7d0bef1a2cdafe0d0f7922a981b2b48369a4f8c1b077be5c171804534c3509dfe950dde15fbe6d828
   languageName: node
   linkType: hard