[max-ostapenko]

Summary

Resolves the open Dependabot alerts for minimatch (GHSA-g3hv-75wg-m249, DoS via globparts amplification; vulnerable >= 7.0.0, < 11.0.1, patched in 11.0.1).

• Fixes #205 (/package-lock.json) and #206 (/test-project/package-lock.json).
• Not fixed: deepmerge alerts #199 and #202 (low, <= 4.3.1). No patched version exists upstream. deepmerge comes in through jest-config (root) and @dataform/cli (test-project), and npm audit fix --force would only "fix" it by downgrading jest to 25. These two alerts stay open until deepmerge publishes a fix.

Why overrides

minimatch 9.x and 10.x are pinned by glob, eslint, editorconfig and others, and no patched 9.x or 10.x release exists, so a plain npm update cannot reach 11.x.

• Root package.json: "minimatch@>=7 <11.0.1": "^11.0.5".
• test-project/package.json: the same minimatch override, plus "glob@^10": "^13.0.6". glob 10.x finds no files when run with minimatch 11, and Dataform CLI 3.0.48 (tested in CI) globs project definitions through it. glob 13 works with minimatch 11.
• The override is limited to the vulnerable range, so glob 7 / minimatch 3 under Dataform CLI 2.4.2 is untouched.
• test-project/package-lock.json also had stale ../node_modules/* entries (the linked root package's dependencies) pinning minimatch 9.0.9. npm does not re-resolve these on its own, so I updated them by hand to match what npm resolves for the same tree (minimatch 11.0.5 with brace-expansion 5, balanced-match 4 and @isaacs/nonrecursive-glob-match). npm install --package-lock-only leaves the result unchanged.

minimatch 11 requires Node 20 || >=22. CI and publish use Node 20, and minimatch is only a dev-time dependency (the published package has none).

Verification

Node 24 locally, clean node_modules each time:

• Root: npm ci, npm run lint and npm test -- 2.4.2 / npm test -- 3.0.48 pass (93 jest tests, integration verification for both Dataform versions).
• test-project/: npm ci works.
• npm audit in both: the minimatch advisory is gone and only deepmerge (low) is left among the tracked advisories.
• Not checked: npm run test:single fails on main too (dataform.json and workflow_settings.yaml both exist), so it can't be used as a check. Compiling with CLI 3.1.2 directly fails on main as well, with "Cannot require ... outside of project directory" for the linked package.

Does not touch .github/dependabot.yml or ci.yml (see #92).