From 327d3409160c861b2f8e7083f1520e3c8eeca9c6 Mon Sep 17 00:00:00 2001
From: Michael Gasperini <michael@mikesoft.it>
Date: Sat, 31 Oct 2026 23:04:20 +0100
Subject: [PATCH] fix(deps): override minimatch to ^11.0.1 under @vscode/vsce

GHSA-g3hv-75wg-m249 (minimatch <11.0.1, moderate) has no upstream fix: vsce 4.x still requires ^10.2.6 and fails the moderate audit gate on main. Pin the transitive copy via a scoped override until vsce ships minimatch 11. Verified: npm audit reports 0 vulnerabilities, vsce ls packaging dry run passes, 122 unit tests green.
---
 package-lock.json | 16 ++++++++++++----
 package.json      |  5 +++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c65db04..9b490a1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -208,6 +208,13 @@
         "node": ">=0.8.0"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz",
+      "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@napi-rs/keyring": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.3.0.tgz",
@@ -1976,13 +1983,14 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz",
+      "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.0.3",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
         "node": "18 || 20 || >=22"
diff --git a/package.json b/package.json
index 842cf70..39bbbad 100644
--- a/package.json
+++ b/package.json
@@ -569,6 +569,11 @@
   "allowScripts": {
     "@vscode/vsce-sign@2.1.0": true
   },
+  "overrides": {
+    "@vscode/vsce": {
+      "minimatch": "^11.0.1"
+    }
+  },
   "devDependencies": {
     "@types/node": "^22.20.5",
     "@types/vscode": "1.93.0",