[dependabot]

Bumps minimatch from 10.2.6 to 11.0.1.

Changelog

Sourced from minimatch's changelog.

change log

11.0

• Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.
• Remove makeRe(), Minimatch#regexp, and the MMRegExp type.
• Remove the AST class.
• Remove the maxExtglobRecursion option.
• An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.
• Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.
• Remove the debug option and the debug() method.
• Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.
• Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.
• Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.
• partial matching of patterns with many ** no longer takes exponential time.
• On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.
• On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.
• On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....
• At optimization level 2, stop splitting **/.. portions once there are braceExpandMax patterns, and do not dedupe sets of more than 1000 patterns. Before, a short pattern could take minutes to compile.
• minimatch() keeps the 256 Minimatch objects that it used most recently, so it does not compile the same pattern again.
• Faster to compile brace patterns that make rows that are merged, such as **/*.{png,jpg,gif}, because the Matchers for the rows that are merged are not made.

10.2

... (truncated)

Commits

• 47afe88 11.0.1
• 77a0f5c limit **/.. optimization pass to avoid quadratic explosion
• 6f9f131 11.0.0
• 02dcbe4 update oxlint
• 47b5d1a handle //?/UNC/host/share long UNC forms
• 05bce27 do not optimize out the windows root
• ba01806 document that a / takes priority over extglob sections
• e5c04b4 correct 'partial' mode matching of multiple-** patterns
• cff11d8 compare UNC host/share case-insensitively
• c86670e benchmark scripts
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clanky-the-clanker]

⚠️ Minor issues — pnpm-lock.yaml still pins minimatch 10.2.6 for packages/cli. Every CI, prerelease and release job runs pnpm install --frozen-lockfile, so all of them will fail until the lockfile is regenerated.

Findings: 1 warning · 1 suggestion (1 is an inline comment on the diff)

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #468.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## WARNING (1)

### [Code Quality] pnpm-lock.yaml still pins minimatch 10.2.6 for packages/cli (pnpm-lock.yaml:329-331). `pnpm install --frozen-lockfile` (.github/actions/install-dependencies/action.yml) will fail in CI, prerelease and release workflows.
- **File:** packages/cli/package.json:99

## SUGGESTION (1)

### [Code Quality] minimatch 11 rewrites `partial` matching of `**` patterns and changes Windows path handling. `bookkeeping.ts:156` uses partial mode to decide which migration subdirectories to descend into, so confirm that the existing tests cover nested and Windows patterns.
- **File:** packages/cli/src/commands/d1/migrations/bookkeeping.ts:156

---

📋 Code Quality: ⚠️ 1 warning · 1 suggestion

The lockfile was not updated, which breaks frozen-lockfile installs. The major bump also changes partial matching, which d1 migrations rely on.

Recommendation: 📝 Minor Comments

• [WARNING] pnpm-lock.yaml still pins minimatch 10.2.6 for packages/cli (pnpm-lock.yaml:329-331). pnpm install --frozen-lockfile (.github/actions/install-dependencies/action.yml) will fail in CI, prerelease and release workflows. (packages/cli/package.json:99)
• [SUGGESTION] minimatch 11 rewrites partial matching of ** patterns and changes Windows path handling. bookkeeping.ts:156 uses partial mode to decide which migration subdirectories to descend into, so confirm that the existing tests cover nested and Windows patterns. (packages/cli/src/commands/d1/migrations/bookkeeping.ts:156)

View full review

Lockfile drift (packages/cli/package.json:99)

• package.json now pins "minimatch": "11.0.1". For the packages/cli importer, pnpm-lock.yaml:329-331 still has specifier: 10.2.6 / version: 10.2.6. The pull request changes no other file.
• .github/actions/install-dependencies/action.yml runs pnpm install --frozen-lockfile. That composite action is used by ci.yml, changesets.yml, prerelease.yml and cli-startup-bench.yml. pnpm refuses a frozen install when an importer's specifier differs from package.json, so every one of these jobs fails, including the release builds, until the lockfile is regenerated.
• Fix: run pnpm install and commit the updated pnpm-lock.yaml, or comment @dependabot recreate.

Major-version behaviour change (packages/cli/src/commands/d1/migrations/bookkeeping.ts:156)

• listFilesRelative decides which directories to descend into with matcher.match(childRel, true /* partial */). The 11.0 changelog says partial matching of ** patterns was rewritten, and that empty path portions now match only empty pattern portions. It also changes how Windows drive letters and UNC paths are handled.
• The other call sites (bookkeeping.ts, create.ts) use only new Minimatch(...) and .match(). None of the removed APIs (makeRe, AST, debug, matchOne) are used, so the code should still compile.
• No tests are changed. Before merging, it's worth confirming that the d1 migrations tests cover nested patterns such as **/*.sql and */migration.sql, partial-mode pruning, and Windows paths.

---

✅ All other checks passed

📝 Documentation: ✅ LGTM

No documentation changes are needed for this dependency bump.

---

_{Reviewed commit: d0f26809}

[clanky-the-clanker]

⚠️ WARNING · Code Quality

pnpm-lock.yaml still pins minimatch 10.2.6 for packages/cli (pnpm-lock.yaml:329-331). pnpm install --frozen-lockfile (.github/actions/install-dependencies/action.yml) will fail in CI, prerelease and release workflows.

pnpm-lock.yaml:329-331 still records specifier: 10.2.6 for this dependency, and this pull request changes only package.json. The shared install action runs pnpm install --frozen-lockfile, which fails when an importer's specifier differs from the lockfile. That breaks CI and the prerelease/release workflows. To fix, regenerate and commit the lockfile (pnpm install, or @dependabot recreate).