glob 13.0.0 (GHSA-3g3m-2fjr-6pw4, fixed in 14.0.2) reaches the lockfile only
through node-gyp -> make-fetch-happen -> cacache, which yarn adds for the
optional macOS fsevents build. cacache calls glob(pattern, options) with
'*(content-*|index-*)' and '**' patterns; glob 14.0.2 returns the same paths
for both.
glob 14.0.2 needs minimatch ^11 and @isaacs/nonrecursive-glob-match ^1.0.1;
pin them to 11.0.1 and 1.0.1, the releases at least 14 days old. The
minimatch 10.2.6 used by eslint stays: eslint-plugin-import-x 4.17.1 imports
makeRe, which minimatch 11 removed, so forcing it fails every lint run.
Specs that replace a module need mock.module from node:test, which
Node only exposes behind this flag. The runner rejected unknown flags,
so there was no way to turn it on. It is now accepted and forwarded to
node like --import and --require.
The repo's own test run enables it, and a spec checks that a module
registered as a mock is what a later dynamic import receives.
braces 3.0.3, the latest upstream release, has an open advisory with no
fixed version (CVE-2026-93687: deeply nested patterns exhaust the stack
in its recursive AST walkers). @pezkuwi/braces is a fork that rejects
nesting deeper than maxDepth (500) with a SyntaxError; its tests include
the upstream suite.
- Updated all copyright headers from 2025 to 2026 (system date shows 2026)
- Added build output files to eslint ignore list in packages/dev/config/eslint.js
- Added build output patterns to .gitignore
- Ignored: packages/*/*.{d.ts,js,mjs,cjs}, packages/*/cjs/**, packages/*/env/**,
packages/*/rootJs/**, packages/*/rootStatic/**
- Successfully resolved 521 lint errors by properly ignoring generated files
- Build outputs should not be linted (source files are linted instead)
- Lint and build now pass successfully
SatoshiQaziMuhammed