[dependabot]

Bumps glob to 14.0.4 and updates ancestor dependency @fastify/static. These dependencies need to be updated together.

Updates glob from 13.0.6 to 14.0.4

Changelog

Sourced from glob's changelog.

changeglob

14

• Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
• Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
• Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
• Remove the debug option, which minimatch no longer has.
• Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
• GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
• ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
• ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
• On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
• Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
• Allow const string[] or readonly string[] as ignore option or pattern argument.
• When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

13

• Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

• Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

... (truncated)

Commits

• 240dbb7 14.0.4
• c6105eb minimatch@11.0.5
• 81544ff minimatch@11.0.3
• 0159413 more readme formatting/typo fixing
• 8652101 fix typo in JSDoc of the "cwd" option
• fc93fd5 14.0.3
• cfdf76a update deps
• 54bbe8b fix windows test
• 18a539f ci: update node versions
• 93957bf 14.0.2
• Additional commits viewable in compare view

Updates @fastify/static from 10.1.3 to 10.1.10

Release notes

Sourced from @​fastify/static's releases.

v10.1.10

What's Changed

• fix: use @​fastify/error for forbidden path errors by @​SkySails in fastify/fastify-static#624 The 403 response for forbidden paths now includes code: "FST_STATIC_FORBIDDEN_PATH"; the error no longer has a status property, use statusCode.

New Contributors

• @​SkySails made their first contribution in fastify/fastify-static#624

Full Changelog: fastify/fastify-static@v10.1.9...v10.1.10

v10.1.9

What's Changed

• chore: bump fastify/workflows/.github/workflows/reusable-release.yml from b1a11bce713bc857e52b2231fec3c89071ad3135 to 731d0cca9a6a5b9586dad6b0326d49001ab9216f by @​dependabot[bot] in fastify/fastify-static#621
• build(deps): bump glob from ^13.0.0 to ^14.0.0 by @​mcollina in fastify/fastify-static#627
• fix: return callNotFound for directories without index file by @​mcollina in fastify/fastify-static#626
• fix: try every encoding in a root before falling back to the next root by @​RaphaelFakhri in fastify/fastify-static#629

New Contributors

• @​RaphaelFakhri made their first contribution in fastify/fastify-static#629

Full Changelog: fastify/fastify-static@v10.1.8...v10.1.9

v10.1.8

What's Changed

• docs: document the dotfiles option and its default by @​mcollina in fastify/fastify-static#619

Full Changelog: fastify/fastify-static@v10.1.7...v10.1.8

v10.1.7

What's Changed

• fix: serve and list files with # or ? in their names by @​lprnmns in fastify/fastify-static#616

Full Changelog: fastify/fastify-static@v10.1.6...v10.1.7

v10.1.6

What's Changed

• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-static#615

Full Changelog: fastify/fastify-static@v10.1.5...v10.1.6

v10.1.5

What's Changed

• fix: use registered root for relative downloads by @​lprnmns in fastify/fastify-static#610

New Contributors

• @​lprnmns made their first contribution in fastify/fastify-static#610

... (truncated)

Commits

• a006a4f Bumped v10.1.10
• 3677646 fix: use @​fastify/error for forbidden path errors (#624)
• d4e7392 Bumped v10.1.9
• 44b5a14 fix: try every encoding in a root before falling back to the next root (#629)
• 55c7bc9 fix: return callNotFound for directories without index file (#626)
• 2d0c537 build(deps): bump glob from ^13.0.0 to ^14.0.0
• 8f2bf52 chore: bump fastify/workflows/.github/workflows/reusable-release.yml
• 4e0e7e3 Bumped v10.1.8
• b2974e0 chore: lower min-release-age to 6 days to unblock 10.1.8 release
• 5b382cd docs: document the dotfiles option and its default
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/static since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@fastify/send	4.2.1	Unknown	Unknown
npm/@fastify/static	10.1.10	🟢 7.7	Details Check Score Reason Maintained 🟢 10 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 2 Found 6/25 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 7 SAST tool is not run on all commits -- score normalized to 7
npm/@isaacs/nonrecursive-glob-match	1.1.0	Unknown	Unknown
npm/brace-expansion	5.0.12	🟢 7	Details Check Score Reason Code-Review ⚠️ 1 Found 3/16 approved changesets -- score normalized to 1 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 10 12 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/content-disposition	3.0.0	🟢 6.6	Details Check Score Reason Code-Review 🟢 6 Found 20/30 approved changesets -- score normalized to 6 Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 16 existing vulnerabilities detected SAST 🟢 9 SAST tool detected but not run on all commits Dependency-Update-Tool 🟢 10 update tool detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected CI-Tests 🟢 9 24 out of 26 merged PRs checked by a CI test -- score normalized to 9 Contributors 🟢 10 project has 21 contributing companies or organizations
npm/glob	14.0.4	🟢 5	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 SAST ⚠️ 0 no SAST tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 5 6 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 10 security policy file detected
npm/minimatch	11.0.5	🟢 5.5	Details Check Score Reason Code-Review ⚠️ 0 Found 1/28 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 4 2 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 4 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/path-scurry	3.0.0	🟢 5	Details Check Score Reason Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json