glob@10.5.0 is deprecated and pulls a vulnerable brace-expansion@2.1.2 — please upgrade or switch #90

Initial checklist

• I read the support docs
• I read the contributing guide
• I agree to follow the code of conduct
• I searched issues and discussions and couldn’t find anything (or linked relevant results below)

Problem

glob@10.5.0 → minimatch@9.0.4 → brace-expansion@^2.0.1 → resolves to brace-expansion@2.1.2.
brace-expansion@2.1.2 is affected by GHSA-mh99-v99m-4gvg / CVE-2026-14257 (High, 7.5; published 2026-07-23)

Current solutions

1. Upgrade glob to 13.x → minimatch@^10.2.2 → brace-expansion@^5.0.5 → 5.0.8 (patched). Removes both the deprecation and the CVE, but requires Node >= 18.
2. Switch to tinyglobby or fdir (both node >=12, no brace-expansion) — drops the deprecated glob and the vulnerable transitive dep while keeping the current Node support. Likely the better fit if you want to avoid forcing Node 18+.

Proposed solutions

If you need help, let me know.