deps: Bump minimatch from 10.2.6 to 11.0.3 by dependabot[bot] · Pull Request #1693 · UI5/cli

dependabot · 2026-11-01T10:04:19Z

Bumps minimatch from 10.2.6 to 11.0.3.

Changelog

change log

11.0

Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.

Remove makeRe(), Minimatch#regexp, and the MMRegExp type.

Remove the AST class.

Remove the maxExtglobRecursion option.

An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.

Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.

Remove the debug option and the debug() method.

Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.

Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.

Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.

partial matching of patterns with many ** no longer takes exponential time.

On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.

On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.

On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....

At optimization level 2, stop splitting **/.. portions once there are braceExpandMax patterns, and do not dedupe sets of more than 1000 patterns. Before, a short pattern could take minutes to compile.

minimatch() keeps the 256 Minimatch objects that it used most recently, so it does not compile the same pattern again.

Faster to compile brace patterns that make rows that are merged, such as **/*.{png,jpg,gif}, because the Matchers for the rows that are merged are not made.

10.2

... (truncated)

Commits

b0c2aa8 11.0.3
293267a perf: cache matchers more aggressively by postponing creation
52d2aec cache 256 patterns
4380455 11.0.2
322feb1 update @isaacs/nonrecursive-glob-match
96cad78 ci: exclude windows from testing node 22 and 24
47afe88 11.0.1
77a0f5c limit **/.. optimization pass to avoid quadratic explosion
6f9f131 11.0.0
02dcbe4 update oxlint
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.2.6 to 11.0.3. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.2.6...v11.0.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 11.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

🚜 New release prepared --- <details><summary>builder: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](builder-v5.0.0-alpha.14...builder-v5.0.0-alpha.15) (2026-11-02) ### chore * **builder:** Synchronize ui5-cli-packages versions ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * devDependencies * @ui5/project bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>cli: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](cli-v5.0.0-alpha.14...cli-v5.0.0-alpha.15) (2026-11-02) ### Features * **cli:** Display specVersion in tree output ([cfb7637](cfb7637)) ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/builder bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/project bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/server bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>fs: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](fs-v5.0.0-alpha.14...fs-v5.0.0-alpha.15) (2026-11-02) ### Dependencies * Bump minimatch from 10.2.6 to 11.0.3 ([#1693](#1693)) ([d0549d5](d0549d5)) * The following workspace dependencies were updated * dependencies * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>logger: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](logger-v5.0.0-alpha.14...logger-v5.0.0-alpha.15) (2026-11-02) ### chore * **logger:** Synchronize ui5-cli-packages versions </details> <details><summary>project: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](project-v5.0.0-alpha.14...project-v5.0.0-alpha.15) (2026-11-02) ### Bug Fixes * **project:** Require HTTPS for Maven snapshot requests ([ab7bcc0](ab7bcc0)) ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * peerDependencies * @ui5/builder bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>server: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](server-v5.0.0-alpha.14...server-v5.0.0-alpha.15) (2026-11-02) ### Bug Fixes * **server:** Redact home directory paths from dev-server error responses ([ded7e44](ded7e44)) ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/builder bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * devDependencies * @ui5/project bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.2.6 to 11.0.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/minimatch/blob/main/changelog.md">minimatch's changelog</a>.</em></p> <blockquote> <h1>change log</h1> <h2>11.0</h2> <ul> <li>Match each path portion with <code>Matcher</code> from <code>@isaacs/nonrecursive-glob-match</code>, in place of a <code>RegExp</code>. Items in <code>Minimatch.set</code> are now strings, <code>Matcher</code> objects, or <code>GLOBSTAR</code>.</li> <li>Remove <code>makeRe()</code>, <code>Minimatch#regexp</code>, and the <code>MMRegExp</code> type.</li> <li>Remove the <code>AST</code> class.</li> <li>Remove the <code>maxExtglobRecursion</code> option.</li> <li>An empty path portion, such as the last one in <code>a/b/</code>, only matches an empty pattern portion. So <code>a/b/</code> no longer matches <code>a/b/?(x)</code> or <code>a/b/*(x)</code>, the same as <code>a/b/*</code>.</li> <li>Add the <code>normalize</code> option, to normalize unicode in the pattern and in each portion of the tested path.</li> <li>Remove the <code>debug</code> option and the <code>debug()</code> method.</li> <li>Remove the <code>matchOne()</code>, <code>slashSplit()</code>, and <code>levelTwoFileOptimize()</code> methods. They are internal now.</li> <li>Fix patterns with more than one <code>**</code> and sections of different lengths between them, such as <code>**/a/b/c/**/d/**</code>, which failed to match some paths since 10.2.3.</li> <li>Fix <code>partial</code> matching of patterns with <code>**</code>, which since 10.2.3 matched some paths under a dot portion that <code>**</code> can not walk, and did not match some paths that end in the pattern's last portion.</li> <li><code>partial</code> matching of patterns with many <code>**</code> no longer takes exponential time.</li> <li>On Windows, a <code>..</code> no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So <code>C:/a/../../x</code> no longer matches <code>x</code> or <code>/x</code>.</li> <li>On Windows, compare the host and share of UNC paths like <code>//host/share/...</code> case-insensitively, the same as drive letters.</li> <li>On Windows, long UNC paths like <code>//?/UNC/host/share/...</code> match <code>//host/share/...</code> and vice versa, the same as <code>//?/c:/...</code> and <code>c:/...</code>.</li> <li>At optimization level 2, stop splitting <code>**/..</code> portions once there are <code>braceExpandMax</code> patterns, and do not dedupe sets of more than 1000 patterns. Before, a short pattern could take minutes to compile.</li> <li><code>minimatch()</code> keeps the 256 <code>Minimatch</code> objects that it used most recently, so it does not compile the same pattern again.</li> <li>Faster to compile brace patterns that make rows that are merged, such as <code>**/*.{png,jpg,gif}</code>, because the <code>Matcher</code>s for the rows that are merged are not made.</li> </ul> <h2>10.2</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/b0c2aa83161cb6aaa19fa2e612f0b64edffd18ee"><code>b0c2aa8</code></a> 11.0.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/293267a27c25c5a91116028d16bb624133f8d8b0"><code>293267a</code></a> perf: cache matchers more aggressively by postponing creation</li> <li><a href="https://github.com/isaacs/minimatch/commit/52d2aecceb71dae7f1b19675e74e044eb472c1e6"><code>52d2aec</code></a> cache 256 patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/43804554971ee0c526723fc5f7c898ce954c390e"><code>4380455</code></a> 11.0.2</li> <li><a href="https://github.com/isaacs/minimatch/commit/322feb18b3f69fa9e2c20c5f4bd3af54e91a3d35"><code>322feb1</code></a> update <code>@isaacs/nonrecursive-glob-match</code></li> <li><a href="https://github.com/isaacs/minimatch/commit/96cad78b5a9b2774baade374bd44bd7803425a3e"><code>96cad78</code></a> ci: exclude windows from testing node 22 and 24</li> <li><a href="https://github.com/isaacs/minimatch/commit/47afe882784638ccdee8d30e0b7516aed2b589a9"><code>47afe88</code></a> 11.0.1</li> <li><a href="https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8"><code>77a0f5c</code></a> limit **/.. optimization pass to avoid quadratic explosion</li> <li><a href="https://github.com/isaacs/minimatch/commit/6f9f13168f7172d2ef824eef6c3a47e1517ae94a"><code>6f9f131</code></a> 11.0.0</li> <li><a href="https://github.com/isaacs/minimatch/commit/02dcbe4610403da9f0f14a7a270c7455f0ae5cdd"><code>02dcbe4</code></a> update oxlint</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v10.2.6...v11.0.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=minimatch&package-manager=npm_and_yarn&previous-version=10.2.6&new-version=11.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

🚜 New release prepared --- <details><summary>builder: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](builder-v5.0.0-alpha.14...builder-v5.0.0-alpha.15) (2026-11-02) ### chore * **builder:** Synchronize ui5-cli-packages versions ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * devDependencies * @ui5/project bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>cli: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](cli-v5.0.0-alpha.14...cli-v5.0.0-alpha.15) (2026-11-02) ### Features * **cli:** Display specVersion in tree output ([cfb7637](cfb7637)) ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/builder bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/project bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/server bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>fs: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](fs-v5.0.0-alpha.14...fs-v5.0.0-alpha.15) (2026-11-02) ### Dependencies * Bump minimatch from 10.2.6 to 11.0.3 ([#1693](#1693)) ([d0549d5](d0549d5)) * The following workspace dependencies were updated * dependencies * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>logger: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](logger-v5.0.0-alpha.14...logger-v5.0.0-alpha.15) (2026-11-02) ### chore * **logger:** Synchronize ui5-cli-packages versions </details> <details><summary>project: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](project-v5.0.0-alpha.14...project-v5.0.0-alpha.15) (2026-11-02) ### Bug Fixes * **project:** Require HTTPS for Maven snapshot requests ([ab7bcc0](ab7bcc0)) ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * peerDependencies * @ui5/builder bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> <details><summary>server: 5.0.0-alpha.15</summary> ## [5.0.0-alpha.15](server-v5.0.0-alpha.14...server-v5.0.0-alpha.15) (2026-11-02) ### Bug Fixes * **server:** Redact home directory paths from dev-server error responses ([ded7e44](ded7e44)) ### Dependencies * The following workspace dependencies were updated * dependencies * @ui5/builder bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/fs bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * @ui5/logger bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 * devDependencies * @ui5/project bumped from ^5.0.0-alpha.14 to ^5.0.0-alpha.15 </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

dependabot Bot added dependencies Automated dependency update javascript Pull requests that update Javascript code labels Nov 1, 2026

d3xter666 mentioned this pull request Nov 2, 2026

deps: Bump minimatch from 10.2.6 to 11.0.1 #1691

Closed

d3xter666 approved these changes Nov 2, 2026

View reviewed changes

d3xter666 merged commit d0549d5 into main Nov 2, 2026
75 checks passed

d3xter666 deleted the dependabot/npm_and_yarn/minimatch-11.0.3 branch November 2, 2026 10:51

github-actions Bot mentioned this pull request Nov 2, 2026

release: UI5 CLI packages main #1686

Merged

Navigation Menu

Repository navigation

deps: Bump minimatch from 10.2.6 to 11.0.3 - #1693

deps: Bump minimatch from 10.2.6 to 11.0.3#1693
d3xter666 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minimatch-11.0.3

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

change log

11.0

10.2

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant