Update several subpackages from glob 10.5.0 to glob 13
envgap__jestjs__jest-16291
01 / FAILURE SIGNATURE
As reported upstream
No identifying execution failure has been captured.
Not a benchmark task.
- In a clean container the reported failure did not reproduce, or the known fix did not make the project run.
02 / ENVIRONMENT RECIPE
- Base commit
e95d9dbbec2a727c304ba34130b6ab1a4533e765- Manifest
package.json- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
jestjs/jest #16291 · read the original issue
### Version
30.4.2
### Steps to reproduce
See [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg); need latest Glob 13 to get latest minimatch, to get the fix for brace-expansion.
```
├─┬ jest@30.4.2
│ └─┬ @jest/core@30.4.2
│ └─┬ @jest/reporters@30.4.1
│ └─┬ glob@10.5.0
│ └─┬ minimatch@9.0.9
│ └── brace-expansion@2.1.2
```
Note, unlike #15910 this does _not_ depend on babel-plugin-istanbul; glob is depended on directly here
### Expected behavior
no audit warnings
### Actual behavior
My audit report; excuse the noise.
```
brace-expansion <=5.0.7
Severity: high
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix --force`
Will install jest@25.0.0, which is a breaking change
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion
minimatch 2.0.0 - 10.0.2
Depends on vulnerable versions of brace-expansion
node_modules/glob/node_modules/minimatch
node_modules/minimatch
glob 4.3.0 - 10.5.0
Depends on vulnerable versions of minimatch
node_modules/glob
node_modules/test-exclude/node_modules/glob
@jest/reporters *
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of glob
node_modules/@jest/reporters
jest-config >=19.1.0-alpha.eed82034
Depends on vulnerable versions of babel-jest
Depends on vulnerable versions of glob
Depends on vulnerable versions of jest-circus
Depends on vulnerable versions of jest-runner
node_modules/jest-config
jest-cli >=19.1.0-alpha.eed82034
Depends on vulnerable versions of @jest/core
Depends on vulnerable versions of jest-config
node_modules/jest-cli
jest >=19.1.0-alpha.eed82034
Depends on vulnerable versions of @jest/core
Depends on vulnerable versions of jest-cli
node_modules/jest
ts-jest >=25.10.0-alpha.1
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of babel-jest
Depends on vulnerable versions of jest
node_modules/ts-jest
jest-runtime >=24.0.0-alpha.0
Depends on vulnerable versions of @jest/globals
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of glob
Depends on vulnerable versions of jest-snapshot
node_modules/jest-runtime
@jest/core *
Depends on vulnerable versions of @jest/reporters
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of jest-config
Depends on vulnerable versions of jest-resolve-dependencies
Depends on vulnerable versions of jest-runner
Depends on vulnerable versions of jest-runtime
Depends on vulnerable versions of jest-snapshot
node_modules/@jest/core
jest-circus >=25.2.4
Depends on vulnerable versions of @jest/expect
Depends on vulnerable versions of jest-runtime
Depends on vulnerable versions of jest-snapshot
node_modules/jest-circus
jest-runner >=24.0.0-alpha.0
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of jest-runtime
node_modules/jest-runner
test-exclude 4.2.2 || 5.0.0 - 7.0.2
Depends on vulnerable versions of glob
Depends on vulnerable versions of minimatch
node_modules/test-exclude
babel-plugin-istanbul 5.0.1 - 7.0.1
Depends on vulnerable versions of test-exclude
node_modules/babel-plugin-istanbul
@jest/transform *
Depends on vulnerable versions of babel-plugin-istanbul
node_modules/@jest/transform
babel-jest >=24.0.0-alpha.0
Depends on vulnerable versions of @jest/transform
Depends on vulnerable versions of babel-plugin-istanbul
node_modules/babel-jest
jest-snapshot >=27.0.0-next.0
Depends on vulnerable versions of @jest/transform
node_modules/jest-snapshot
@jest/expect *
Depends on vulnerable versions of jest-snapshot
node_modules/@jest/expect
@jest/globals >=28.0.0-alpha.0
Depends on vulnerable versions of @jest/expect
node_modules/@jest/globals
jest-resolve-dependencies >=27.0.0-next.0
Depends on vulnerable versions of jest-snapshot
node_modules/jest-resolve-dependencies
20 high severity vulnerabilities
```
### Additional context
_No response_
### Environment
```shell
@jest/reporters@30.4.1
```04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]