Bump glob from 7.2.3 to 13.0.6

[dependabot]

Bumps glob from 7.2.3 to 13.0.6.

Changelog

Sourced from glob's changelog.

changeglob

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

• Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
• Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
• Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

• Drop support for node before v20

10.4

• Add includeChildMatches: false option
• Export the Ignore class

10.3

• Add --default -p flag to provide a default pattern
• exclude symbolic links to directories when follow and nodir are both set

10.2

• Add glob cli

10.1

• Return '.' instead of the empty string '' when the current working directory is returned as a match.
• Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

• e80cb38 13.0.6
• 9cdbbff revert tsgo, not ready for test coverage correctness yet
• 89c99ba use tsgo compiler
• b7275d5 update deps, expand engines to include node 18
• 942e360 update workflows, pull taprc out of package.json
• 4a0d53c update tap for mockImport bugfix
• ef94ad2 update tap
• 180c2d4 update docs
• 37993c8 remove stray console.error in test
• 03ae4c2 13.0.5
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[gep13]

Category: Defer — known API break (glob 7 → 13)

glob 8+ removed the callback API entirely in favour of Promise/async. Our test suite bootstrapper in src/test/suite/index.ts uses exactly the removed form:

glob("**/*.test.js", { cwd: testsRoot }, (err: Error | null, files: string[]) => {
    if (err) return reject(err);
    files.forEach(f => mocha.addFile(path.resolve(testsRoot, f)));
    ...
});

Bumping forces rewriting that to:

const files = await glob("**/*.test.js", { cwd: testsRoot });

Small change, but it's a real code edit + needs index.ts's run() to be async.

glob 7.x also has CVE-2023-26136 transitively via tough-cookie, which is one of the reasons dependabot keeps flagging it — worth fixing eventually.

Recommendation: defer to a small dedicated PR "Migrate glob to async API and bump to ^13". Low-medium effort, one file.