chore(deps): bump the npm_and_yarn group across 15 directories with 20 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: glob and minimatch.
Bumps the npm_and_yarn group with 5 updates in the /genkit-tools directory:

Package	From	To
glob	10.4.5	12.0.0
axios	1.10.0	1.13.5
@trpc/server	10.45.2	10.45.3
js-yaml	4.1.0	4.1.1
yaml	2.8.0	2.8.3

Bumps the npm_and_yarn group with 2 updates in the /js directory: yaml and next.
Bumps the npm_and_yarn group with 1 update in the /js/testapps/next directory: next.
Bumps the npm_and_yarn group with 9 updates in the /samples/js-angular/genkit-app directory:

Package	From	To
brace-expansion	1.1.11	1.1.12
brace-expansion	2.0.1	2.0.2
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
yaml	2.7.0	2.8.3
qs	6.13.0	6.14.2
@angular/compiler	19.2.0	19.2.18
@angular/core	19.2.0	19.2.20
tar	6.2.1	7.5.13
flatted	3.3.2	3.4.2
serialize-javascript	6.0.2	7.0.5

Bumps the npm_and_yarn group with 10 updates in the /samples/js-angular/server directory:

Package	From	To
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
minimatch	9.0.5	9.0.9
axios	1.11.0	1.13.6
@trpc/server	10.45.2	10.45.4
js-yaml	4.1.0	4.1.1
yaml	2.8.1	2.8.3
jws	4.0.0	4.0.1
jws	3.2.2	3.2.3
picomatch	2.3.1	2.3.2
fast-xml-parser	4.5.3	5.5.9

Bumps the npm_and_yarn group with 12 updates in the /samples/js-character-generator directory:

Package	From	To
brace-expansion	2.0.1	2.0.2
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
minimatch	9.0.5	9.0.9
tmp	0.0.33	removed
axios	1.7.9	1.13.6
@trpc/server	10.45.0	10.45.4
yaml	2.8.1	2.8.3
form-data	2.5.2	2.5.5
jws	4.0.0	4.0.1
jws	3.2.2	3.2.3
qs	6.13.0	6.14.2
fast-xml-parser	4.5.3	5.5.9

Bumps the npm_and_yarn group with 7 updates in the /samples/js-chatbot directory:

Package	From	To
brace-expansion	2.0.1	2.0.2
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
minimatch	9.0.5	9.0.9
tmp	0.0.33	removed
axios	1.7.9	1.13.6
@trpc/server	10.45.0	10.45.4

Bumps the npm_and_yarn group with 9 updates in the /samples/js-chatbot/genkit-app directory:

Package	From	To
brace-expansion	1.1.11	1.1.12
brace-expansion	2.0.1	2.0.2
esbuild	0.21.5	0.27.3
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
yaml	2.7.0	2.8.3
qs	6.13.0	6.14.2
@angular/compiler	18.2.13	21.2.6
@angular/core	18.2.13	21.2.6
tar	6.2.1	7.5.13
flatted	3.3.2	3.4.2

Bumps the npm_and_yarn group with 11 updates in the /samples/js-chatbot/server directory:

Package	From	To
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
minimatch	9.0.5	9.0.9
axios	1.13.1	1.13.6
@trpc/server	10.45.2	10.45.4
js-yaml	4.1.0	4.1.1
yaml	2.8.1	2.8.3
form-data	2.5.2	2.5.5
jws	4.0.0	4.0.1
jws	3.2.2	3.2.3
picomatch	2.3.1	2.3.2
fast-xml-parser	4.5.1	5.5.9

Bumps the npm_and_yarn group with 9 updates in the /samples/js-coffee-shop directory:

Package	From	To
glob	10.4.5	10.5.0
glob	11.0.3	11.1.0
minimatch	9.0.5	9.0.9
axios	1.12.2	1.13.6
@trpc/server	10.45.2	10.45.4
js-yaml	4.1.0	4.1.1
yaml	2.8.1	2.8.3
jws	4.0.0	4.0.1
jws	3.2.2	3.2.3
picomatch	2.3.1	2.3.2
fast-xml-parser	4.5.3	5.5.9

Bumps the npm_and_yarn group with 11 updates in the /samples/js-menu directory:

Package	From	To
brace-expansion	2.0.1	2.0.2
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
glob	11.0.1	11.1.0
minimatch	9.0.5	9.0.9
axios	1.7.9	1.13.6
@trpc/server	10.45.0	10.45.4
yaml	2.8.1	2.8.3
form-data	2.5.2	2.5.5
jws	4.0.0	4.0.1
jws	3.2.2	3.2.3
qs	6.13.0	6.14.2
fast-xml-parser	4.5.1	5.5.9

Bumps the npm_and_yarn group with 9 updates in the /samples/js-prompts directory:

Package	From	To
brace-expansion	2.0.1	2.0.2
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
minimatch	9.0.5	9.0.9
tmp	0.0.33	removed
axios	1.7.9	1.13.6
@trpc/server	10.45.0	10.45.4
jws	4.0.0	4.0.1
qs	6.13.0	6.14.2

Bumps the npm_and_yarn group with 9 updates in the /samples/js-schoolAgent directory:

Package	From	To
brace-expansion	2.0.1	2.0.2
esbuild	0.23.1	0.27.4
glob	10.4.5	10.5.0
glob	11.0.1	11.1.0
minimatch	9.0.5	9.0.9
tmp	0.0.33	removed
axios	1.7.9	1.13.6
@trpc/server	10.45.0	10.45.4
jws	4.0.0	4.0.1
qs	6.13.0	6.14.2

Bumps the npm_and_yarn group with 4 updates in the /tests directory: brace-expansion, minimatch, js-yaml and yaml.

Updates glob from 11.0.3 to 11.1.0

Changelog

Sourced from glob's changelog.

changeglob

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

• Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
• Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
• Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

• Drop support for node before v20

10.4

• Add includeChildMatches: false option
• Export the Ignore class

10.3

• Add --default -p flag to provide a default pattern
• exclude symbolic links to directories when follow and nodir are both set

10.2

• Add glob cli

10.1

• Return '.' instead of the empty string '' when the current working directory is returned as a match.
• Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

• 2551fb5 11.1.0
• 47473c0 bin: Do not expose filenames to shell expansion
• bc33fe1 skip tilde test on systems that lack tilde expansion
• 59bf9ca fix notes
• dde4fa6 docs(README): add #anchor and improve notes
• 0559b0e docs: add better links to path-scurry docs
• c9773c2 fix: correct typos in README.md
• 13e68ea Fix punctuation in traversal function documentation
• 1527e2b fix repo url
• 7e190e8 fix typo maths → paths
• Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates glob from 10.4.5 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

• Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
• Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
• Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

• Drop support for node before v20

10.4

• Add includeChildMatches: false option
• Export the Ignore class

10.3

• Add --default -p flag to provide a default pattern
• exclude symbolic links to directories when follow and nodir are both set

10.2

• Add glob cli

10.1

• Return '.' instead of the empty string '' when the current working directory is returned as a match.
• Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

• 2551fb5 11.1.0
• 47473c0 bin: Do not expose filenames to shell expansion
• bc33fe1 skip tilde test on systems that lack tilde expansion
• 59bf9ca fix notes
• dde4fa6 docs(README): add #anchor and improve notes
• 0559b0e docs: add better links to path-scurry docs
• c9773c2 fix: correct typos in README.md
• 13e68ea Fix punctuation in traversal function documentation
• 1527e2b fix repo url
• 7e190e8 fix typo maths → paths
• Additional commits viewable in compare view

Updates axios from 1.10.0 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

• Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
• Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

• Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

• Fix/5657. (PR #7313)
• Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

• Add input validation to isAbsoluteURL. (PR #7326)
• Refactor: bump minor package versions. (PR #7356)

Documentation

• Clarify object-check comment. (PR #7323)
• Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

• Chore: fix issues with YAML. (PR #7355)
• CI: update workflow YAMLs. (PR #7372)
• CI: fix run condition. (PR #7373)
• Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
• Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

• @​sachin11063 (first contribution — PR #7323)
• @​asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

• fix: issues with version 1.13.3 (#7352) (ee90dfc)
  • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

• http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
• interceptor: handle the error in the same interceptor (#6269) (5945e40)
• main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
• package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
• silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
• turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
• types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
• types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
• unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

• add undefined as a value in AxiosRequestConfig (#5560) (095033c)
• add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
• add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
• added copilot instructions (3f83143)
• compatibility with frozen prototypes (#6265) (860e033)
• enhance pipeFileToResponse with error handling (#7169) (88d7884)
• types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

• Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
• deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

• Ashvin Tiwari
• Nikunj Mochi
• Anchal Singh
• jasonsaayman
• Julian Dax
• Akash Dhar Dubey
• Madhumita
• Tackoil
• Justin Dhillon
• Rudransh
• WuMingDao
• codenomnom
• Nandan Acharya
• Eric Dubé
• Tibor Pilz
• Gabriel Quaresma
• Turadg Aleahmad

... (truncated)

Commits

• 29f7542 chore(release): prepare release 1.13.5 (#7379)
• 431c3a3 ci: fix run condition (#7373)
• 9ff3a78 ci: update ymls (#7372)
• 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
• 475e75a feat: add input validation to isAbsoluteURL (#7326)
• 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
• 04cf019 docs: clarify object check comment (#7323)
• 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
• 569f028 fix: added a option to choose between legacy and the new request/response int...
• 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates @trpc/server from 10.45.2 to 10.45.3

Release notes

Sourced from @​trpc/server's releases.

v10.45.3

• fixes GHSA-43p4-m455-4f4j

Full Changelog: trpc/trpc@v10.45.2...v10.45.3

Commits

• 1117bb3 v10.45.3
• See full diff in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

Commits

• cc482e7 4.1.1 released
• 50968b8 dist rebuild
• d092d86 lint fix
• 383665f fix prototype pollution in merge (<<)
• 0d3ca7a README.md: HTTP => HTTPS (#678)
• 49baadd doc: 'empty' style option for !!null
• ba3460e Fix demo link (#618)
• See full diff in compare view

Updates yaml from 2.8.0 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

v2.8.1

• Preserve empty block literals (#634)

Commits

• ce14587 2.8.3
• 1e84ebb fix: Catch stack overflow during node composition
• 6b24090 ci: Include Prettier check in lint action
• 9424dee chore: Refresh lockfile
• d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
• 4321509 ci: Drop the branch filter from GitHub PR actions
• 47207d0 chore: Update docs-slate
• 5212fae chore: Update docs-slate
• 086fa6b 2.8.2
• 95f01e9 chore: Add funding to package.json
• Additional commits viewable in compare view

Updates form-data from 2.5.1 to 2.5.5

Changelog

Sourced from form-data's changelog.

v2.5.5 - 2025-07-18

Commits

• [meta] actually ensure the readme backup isn’t published 10626c0
• [Fix] use proper dependency 026abe5

v2.5.4 - 2025-07-17

Fixed

• [Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

• [eslint] update linting config 8bf2492
• [meta] add auto-changelog b5101ad
• [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 0e93122
• [Fix] Switch to using crypto random for boundary values b88316c
• [Fix] validate boundary type in setBoundary() method 131ae5e
• [Tests] Switch to newer v8 prediction library; enable node 24 testing c97cfbe
• [Refactor] use hasown 97ac9c2
• [meta] remove local commit hooks be99d4e
• [Dev Deps] remove unused deps ddbc89b
• [meta] fix scripts to use prepublishOnly e351a97
• [Dev Deps] remove unused script 8f23366
• [Dev Deps] add missing peer dep 02ff026
• [meta] fix readme capitalization 2fd5f61

v2.5.3 - 2025-02-14

Merged

• [Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

Fixed

• [Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

Commits

• [Refactor] use Object.prototype.hasOwnProperty.call 6e682d4
• [Dev Deps] update @types/node, browserify, coveralls, eslint, formidable, in-publish, phantomjs-prebuilt, pkgfiles, pre-commit, request, tape, typescript 819f6b7
• Only apps should have lockfiles b170ee2
• [Deps] update combined-stream, mime-types 6b1ca1d
• Bumped version 2.5.3 9457283
• [Dev Deps] pin request which via tough-cookie ^2.4 depends on psl 9dbe192

Commits

• 40de5a7 v2.5.5
• 026abe5 [Fix] use proper dependency
• 10626c0 [meta] actually ensure the readme backup isn’t published
• efe6c26 v2.5.4
• c97cfbe [Tests] Switch to newer v8 prediction library; enable node 24 testing
• 0e93122 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
• b88316c [Fix] Switch to using crypto random for boundary values
• b70869d [Fix] append: avoid a crash on nullish values
• 131ae5e [Fix] validate boundary type in setBoundary() method
• 8bf2492 [eslint] update linting config
• Additional commits viewable in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates yaml from 2.8.0 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

v2.8.1

• Preserve empty block literals (#634)

Commits

• ce14587 2.8.3
• 1e84ebb fix: Catch stack overflow during node composition
• 6b24090 ci: Include Prettier check in lint action
• 9424dee chore: Refresh lockfile
• d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
• 4321509 ci: Drop the branch filter from GitHub PR actions
• 47207d0 chore: Update docs-slate
• 5212fae chore: Update docs-slate
• 086fa6b 2.8.2
• 95f01e9 chore: Add funding to package.json
• Additional commits viewable in compare view

Updates next from 15.3.3 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

• fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits

• d7b012d v15.5.14
• 2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
• f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
• cfd5f53 v15.5.13
• 15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• d23f41c v15.5.12
• 8e75765 fix unlock in publish-native
• 6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
• 7a94645 Apply needs for publishRelease
• bbfd4e3 v15.5.11
• Additional commits viewable in compare view

Updates next from 15.2.4 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

• fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits

• d7b012d v15.5.14
• 2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
• f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
• cfd5f53 v15.5.13
• 15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• d23f41c v15.5.12
• 8e75765 fix unlock in publish-native
• 6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
• 7a94645 Apply needs for publishRelease
• bbfd4e3 v15.5.11
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 44f33b4 1.1.12
• c460dbd pkg: publish on tag 1.x
• ccb8ac6 fmt
• c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• See full diff in compare view

Updates brace-expansion from 2.0.1 to 2.0.2

Release notes

Sourced from brace-expansion's releases.

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 44f33b4 1.1.12
• c460dbd pkg: publish on tag 1.x
• ccb8ac6 fmt
• c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates minimatch from 9.0.5 to 9.0.9

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Description has been truncated

---

Summary by cubic

Update dependencies across tools, JS packages, and sample apps to pick up security fixes and keep frameworks current. Highlights include next 15.5.14, glob 12 in tools, axios 1.13.x, YAML libs 2.8.3, and Angular sample bumps.

• Dependencies

  • Security patches: axios 1.13.5/6 (DoS fix), js-yaml 4.1.1 (prototype pollution), @trpc/server 10.45.x (advisory fix), next 15.5.14 (CVE patch + image cache).
  • glob → 12.0.0 in @genkit-ai/tools-common (drops Node <20; CLI --shell removed). Other workspaces bump to 10.5.x/11.1.x.
  • next → 15.5.14 in js/plugins/next and js/testapps/next.
  • Samples: Angular dependencies updated (some to 19.2.x, some to 21.2.x); esbuild → 0.27.x; yaml → 2.8.3; minimatch patched; fast-xml-parser → 5.x; removed tmp.
  • Tooling bumps in samples: genkit-cli and tsx updated.

• Migration

  • Use Node 20+ when running genkit-tools (required by glob v12) and recommended for Next 15; samples using esbuild need Node 18+.
  • Reinstall deps in each workspace/sample after pulling.
  • If any local scripts used glob CLI with --shell, remove that flag (no longer supported).

^{Written for commit 3a131dd. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 27 files