[vvillait88]

Summary

Maintenance sweep: dev-dependency patch and minor bumps (@types/node 26.6.5 to 26.6.6, eslint 10.13.0 to 10.14.0, knip 6.43.0 to 6.44.1). Requested by Varun as part of the weekly sweep.

Also adds a version-scoped OSV allowlist entry for minimatch 10.2.6 (GHSA-g3hv-75wg-m249, published 2026-10-30). The fix exists only in 11.0.1, every parent (eslint, @eslint/config-array, typescript-estree, eslint-plugin-import-x) caps it at ^10 in its latest release, and it is lint tooling that never reaches dist. main's Dependency Scan fails on the same advisory, so this unblocks main too. The entry expires 2027-01-31.

Not taken: TypeScript 7 stays held at ^6 because typescript-eslint 8.72.1 still peers typescript <6.1.0.

No release: the built dist is byte-identical to main's (diffed both builds), so the next release that ships for a real reason carries this.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Ran locally on the branch: lint, typecheck, knip, test and build all exit 0; osv-scanner over bun.lock with the new config reports no issues across 390 packages; diff -r of dist before and after is empty.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with Claude Code

[vvillait88]

Review: maintenance sweep bumps

Verdict: not mergeable yet. The bumps themselves are correct and the no-release call holds, but the required Dependency Scan check is red, and the cause is not in this diff.

Blocking: required Dependency Scan fails on minimatch GHSA-g3hv-75wg-m249

gh pr checks 116 shows Dependency Scan fail (run 41428161632); every other row passes (ci, node-compat 22/24/26, CodeQL). Dependency Scan is one of the two required checks in the main ruleset (ci, Dependency Scan), so the PR cannot merge as it stands.

• The log: 390 packages scanned, 1 Medium, minimatch 10.2.6, fixed in 11.0.1.
• Pre-existing, not introduced here: osv-scanner scan source --lockfile=bun.lock on a clean origin/main (25fdc1a) exits 1 with the same single finding. The advisory was published 2026-10-30, after main's last green scan (2026-10-29), so main's next push scan fails too.
• No floor can reach the fix. Its range is introduced 0, fixed 11.0.1, with no 10.x backport (versions after 10.2.6 are 11.0.0 to 11.0.4). Every parent's latest release still caps it at 10: eslint 10.14.0 ^10.2.6, @eslint/config-array 0.23.5 ^10.2.4, @typescript-eslint/typescript-estree 8.72.1 ^10.2.2, eslint-plugin-import-x 4.17.1 ^9.0.3 || ^10.1.2. Overriding to 11 would force a major under eslint.
• All four parents are lint tooling that matches patterns we write ourselves, and nothing in dist pulls minimatch in.

Suggested close, following the runbook's OSV check: a version-scoped [[PackageOverrides]] for minimatch@10.2.6 in osv-scanner.toml, with effectiveUntil and the reason. Rewrite the file's "Empty on purpose" header at the same time, because it would otherwise be false. The hivemind agents workspace already carries this exact entry (effectiveUntil = 2027-01-31, lift when the parents admit 11), so copying its wording keeps the repos consistent. This will probably hit every other JS lockfile in the sweep that pulls eslint 10.

Verified, no issues

• Diff: package.json and bun.lock only. @types/node 26.6.5 to 26.6.6, eslint 10.13.0 to 10.14.0, knip 6.43.0 to 6.44.1. The head is ec781db, branched from current main 25fdc1a.
• eslint 10.14.0 raised two transitive ranges (@humanfs/node ^0.16.8, minimatch ^10.2.6). The lock already resolves them at 0.16.8 and 10.2.6 at the root, so no lock entry was needed beyond the ones shown.
• Install: bun install --frozen-lockfile exits 0, 210 packages. The resolved versions are eslint 10.14.0, knip 6.44.1 and @types/node 26.6.6.
• Gates on the head, each exit code read separately: lint 0, typecheck 0, knip 0, test 0, build 0.
  • Test ran 154 passed and 2 skipped (6 files plus 1 skipped).
  • As a positive control for lint, eslint . -f json reports 14 files linted with 0 problems.
• No-release claim holds. I built origin/main and the PR head in separate worktrees. diff -r dist exits 0, and the shasums of all 4 files match (index.js, index.mjs, index.d.ts, index.d.mts). This is dev-only by effect, so under the release check no release is owed.
• Nothing else to take:
  • bun outdated lists only typescript 6.0.3 -> 7.0.2.
  • npm view on all 13 devDependencies shows each locked at its latest except typescript. There are no runtime dependencies, and no overrides or patches.
  • The TypeScript 7 hold stands. typescript-eslint 8.72.1 still peers typescript >=4.8.4 <6.1.0, and 6.0.3 is the newest 6.x.
  • Actions are on floating majors that match upstream: checkout v7, setup-node v7, cache v6, setup-bun v2.
  • The pinned osv-scanner v2.7.0 is the latest release.

[vvillait88]

Review round 2

The blocking finding is resolved, and this is now safe to merge.

• What changed: commit 19e2464 touches only osv-scanner.toml (from the compare API). It adds a scoped [[PackageOverrides]] for minimatch@10.2.6 (npm) with effectiveUntil = 2027-01-31 and a reason. The lift condition is stated: remove it when the parents' latest releases admit 11. The old "Empty on purpose" header is gone. The new comment is accurate against the lock: four lint parents, nothing in the published package.
• The scan: run 41428794556 scanned the same 390 packages and logged Loaded filter from: .../osv-scanner.toml, then No issues found. So the pass comes from the override applying to the same lock, not from the scan doing less work.
• CI on head 19e2464: gh pr checks 116 exits 0. All 9 rows pass, including both required checks, ci and Dependency Scan.

Everything verified in round 1 still holds, because the lock and the manifest are unchanged: the gates, the byte-identical dist, and nothing else to take.