Take minimatch and glob past their advisoriesfix/minimatch-glob-advisories

minimatch 10.2.6 (CVE-2026-118764, denial of service through globparts
amplification) and glob 13.0.6 (CVE-2026-118773, traversal after an
AbortSignal timeout) reach the site through @nuxt/content, nitropack and
c8, whose ranges have not moved. Overrides take them to minimatch 11.0.5
and glob 14.0.4. Both run only while the site is generated, on the files
of this repository, so no visitor could reach them; the override clears
the alerts without waiting for the upstream ranges.

zod 3.25.76 and deepmerge 4.3.1 keep their alerts. Nuxt Content checks
the collections of this repository with zod, and rollup merges its own
options with deepmerge, both at generation time on input from this
repository; zod has no fixed 3.x and deepmerge no fixed release, and
npm's way out is to go back to @nuxt/content 2 and nuxt 4.1.

2 files changed, 24 insertions, 13 deletions

diff --git a/package-lock.json b/package-lock.json
index f4c7492..7bb009e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1005,6 +1005,12 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz",
+      "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
@@ -5455,14 +5461,14 @@
       "license": "ISC"
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "14.0.4",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.4.tgz",
+      "integrity": "sha512-mMiwNKoJZ4HAIRVJxotO6LsNRReA30gQwP9E2/p94tfLv+jygCNpKDjhhSL6OLY6LE371EZm5EAf7RpYuUqlsw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.2",
+        "minimatch": "^11.0.5",
         "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
+        "path-scurry": "^3.0.0"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -8045,15 +8051,16 @@
       "license": "MIT"
     },
     "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz",
+      "integrity": "sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.1.0",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -9385,9 +9392,9 @@
       "license": "MIT"
     },
     "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
diff --git a/package.json b/package.json
index 1cf1315..f28cee3 100644
--- a/package.json
+++ b/package.json
@@ -22,6 +22,10 @@
     "@nuxt/content": "3.16.2",
     "nuxt": "4.6.4"
   },
+  "overrides": {
+    "glob": "^14.0.4",
+    "minimatch": "^11.0.5"
+  },
   "devDependencies": {
     "@types/node": "24.19.2",
     "c8": "12.0.0",