Update several subpackages from glob 10.5.0 to glob 13

[dmurvihill]

Version

30.4.2

Steps to reproduce

See GHSA-mh99-v99m-4gvg; need latest Glob 13 to get latest minimatch, to get the fix for brace-expansion.

├─┬ jest@30.4.2
│ └─┬ @jest/core@30.4.2
│   └─┬ @jest/reporters@30.4.1
│     └─┬ glob@10.5.0
│       └─┬ minimatch@9.0.9
│         └── brace-expansion@2.1.2

Note, unlike #15910 this does not depend on babel-plugin-istanbul; glob is depended on directly here

Expected behavior

no audit warnings

Actual behavior

My audit report; excuse the noise.

brace-expansion  <=5.0.7
Severity: high
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix --force`
Will install jest@25.0.0, which is a breaking change
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion
  minimatch  2.0.0 - 10.0.2
  Depends on vulnerable versions of brace-expansion
  node_modules/glob/node_modules/minimatch
  node_modules/minimatch
    glob  4.3.0 - 10.5.0
    Depends on vulnerable versions of minimatch
    node_modules/glob
    node_modules/test-exclude/node_modules/glob
      @jest/reporters  *
      Depends on vulnerable versions of @jest/transform
      Depends on vulnerable versions of glob
      node_modules/@jest/reporters
      jest-config  >=19.1.0-alpha.eed82034
      Depends on vulnerable versions of babel-jest
      Depends on vulnerable versions of glob
      Depends on vulnerable versions of jest-circus
      Depends on vulnerable versions of jest-runner
      node_modules/jest-config
        jest-cli  >=19.1.0-alpha.eed82034
        Depends on vulnerable versions of @jest/core
        Depends on vulnerable versions of jest-config
        node_modules/jest-cli
          jest  >=19.1.0-alpha.eed82034
          Depends on vulnerable versions of @jest/core
          Depends on vulnerable versions of jest-cli
          node_modules/jest
            ts-jest  >=25.10.0-alpha.1
            Depends on vulnerable versions of @jest/transform
            Depends on vulnerable versions of babel-jest
            Depends on vulnerable versions of jest
            node_modules/ts-jest
      jest-runtime  >=24.0.0-alpha.0
      Depends on vulnerable versions of @jest/globals
      Depends on vulnerable versions of @jest/transform
      Depends on vulnerable versions of glob
      Depends on vulnerable versions of jest-snapshot
      node_modules/jest-runtime
        @jest/core  *
        Depends on vulnerable versions of @jest/reporters
        Depends on vulnerable versions of @jest/transform
        Depends on vulnerable versions of jest-config
        Depends on vulnerable versions of jest-resolve-dependencies
        Depends on vulnerable versions of jest-runner
        Depends on vulnerable versions of jest-runtime
        Depends on vulnerable versions of jest-snapshot
        node_modules/@jest/core
        jest-circus  >=25.2.4
        Depends on vulnerable versions of @jest/expect
        Depends on vulnerable versions of jest-runtime
        Depends on vulnerable versions of jest-snapshot
        node_modules/jest-circus
        jest-runner  >=24.0.0-alpha.0
        Depends on vulnerable versions of @jest/transform
        Depends on vulnerable versions of jest-runtime
        node_modules/jest-runner
      test-exclude  4.2.2 || 5.0.0 - 7.0.2
      Depends on vulnerable versions of glob
      Depends on vulnerable versions of minimatch
      node_modules/test-exclude
        babel-plugin-istanbul  5.0.1 - 7.0.1
        Depends on vulnerable versions of test-exclude
        node_modules/babel-plugin-istanbul
          @jest/transform  *
          Depends on vulnerable versions of babel-plugin-istanbul
          node_modules/@jest/transform
            babel-jest  >=24.0.0-alpha.0
            Depends on vulnerable versions of @jest/transform
            Depends on vulnerable versions of babel-plugin-istanbul
            node_modules/babel-jest
            jest-snapshot  >=27.0.0-next.0
            Depends on vulnerable versions of @jest/transform
            node_modules/jest-snapshot
              @jest/expect  *
              Depends on vulnerable versions of jest-snapshot
              node_modules/@jest/expect
                @jest/globals  >=28.0.0-alpha.0
                Depends on vulnerable versions of @jest/expect
                node_modules/@jest/globals
              jest-resolve-dependencies  >=27.0.0-next.0
              Depends on vulnerable versions of jest-snapshot
              node_modules/jest-resolve-dependencies

20 high severity vulnerabilities

Additional context

No response

Environment

@jest/reporters@30.4.1

[paul1k]

To add to this: @jest/reporters isn't the only package bringing in glob@10.5.0 (and consequently brace-expansion@2.1.2).

The issue is also reproduced across jest-config and jest-runtime:

`-- jest@30.4.2
  `-- @jest/core@30.4.2
    +-- @jest/reporters@30.4.1
    | `-- glob@10.5.0
    |   `-- minimatch@9.0.9
    |     `-- brace-expansion@2.1.2
    +-- jest-config@30.4.2
    | `-- glob@10.5.0
    |   `-- minimatch@9.0.9
    |     `-- brace-expansion@2.1.2
    `-- jest-runtime@30.4.2
      `-- glob@10.5.0
        `-- minimatch@9.0.9
          `-- brace-expansion@2.1.2

[kevin-boutin]

Can we please get some attention on this? I have several vulnerabilities in multiple repos due to using jest as my unit testing package.