Fix npm audit vulnerabilities

eslint.config.mjs

@@ -1,5 +1,5 @@
+import {createRequire} from 'node:module';
 import typescriptEslint from '@typescript-eslint/eslint-plugin';
-import {importX} from 'eslint-plugin-import-x';
 import jest from 'eslint-plugin-jest';
 import prettierRecommended from 'eslint-plugin-prettier/recommended';
 import eslintConfigPrettier from 'eslint-config-prettier';
@@ -7,6 +7,11 @@ import globals from 'globals';
 import tsParser from '@typescript-eslint/parser';
 import js from '@eslint/js';
 
+// Until import-x supports minimatch 11, use its CommonJS entry point to avoid
+// the removed makeRe import in no-internal-modules, unused by these presets.
+// https://github.com/un-ts/eslint-plugin-import-x/pull/570
+const {importX} = createRequire(import.meta.url)('eslint-plugin-import-x');
+
 export default [
   js.configs.recommended,
   ...typescriptEslint.configs['flat/recommended'],

package-lock.json

@@ -828,6 +828,13 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz",
+      "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@istanbuljs/load-nyc-config": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
@@ -3433,9 +3440,9 @@
       "license": "MIT"
     },
     "node_modules/deepmerge": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+      "version": "4.3.2+shivammathur.1",
+      "resolved": "https://codeload.github.com/shivammathur/deepmerge/tar.gz/9e04a97afa90b9d50883dd723f7d0fb0d2c16dca",
+      "integrity": "sha512-r4fnznwnkXKmMFSYuH/DNADs6s2cTFDFE/vXfV4ocEnG4IZ20vDTXrPNRqisYZbNwvno2m0eBUtVrdVX6kbbeg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4105,15 +4112,15 @@
       }
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
+      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.2",
+        "minimatch": "^11.0.2",
         "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
+        "path-scurry": "^3.0.0"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -5176,13 +5183,14 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz",
+      "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.0.3",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -5431,9 +5439,9 @@
       }
     },
     "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {

package.json

@@ -65,10 +65,11 @@
   },
   "overrides": {
     "@babel/core": "^7.29.7",
+    "deepmerge": "https://codeload.github.com/shivammathur/deepmerge/tar.gz/9e04a97afa90b9d50883dd723f7d0fb0d2c16dca",
     "js-yaml": "^4.2.0",
     "test-exclude": "^7.0.1",
-    "glob": "^13.0.6",
-    "minimatch": "^10.2.1"
+    "glob": "^14.0.3",
+    "minimatch": "^11.0.3"
   },
   "bugs": {
     "url": "https://github.com/shivammathur/setup-php/issues"