- minimatch below 11.0.1 can blow up a pattern into a huge set of glob parts
(denial of service). c8 12.0.0, the newest, still pulls test-exclude 8, which
pins minimatch ^10.2.2, so Dependabot cannot raise an update on its own.
- Override minimatch to 11.0.8 and glob to 14.0.4 together: glob 13 reads
Minimatch.set as RegExps, which minimatch 11 replaced with Matcher objects,
and glob 14 is the release built on minimatch 11.
- Dev-only: tools/ is excluded from the registry package by .comfyignore, and
c8 only matches the repo's own coverage globs. npm audit now reports 0.
Vito Sansevero