[chrischall]

Fixes Dependabot alert #8: minimatch < 11.0.1, pattern-amplification DoS (GHSA-g3hv-75wg-m249, medium).

Why an override, and why two packages

• minimatch comes in only through @opencode/plugin's own dependencies (@opencode/util, @npmcli/arborist, @tufjs/models, rimraf→glob…). It's dev-only: we import @opencode/plugin for types and for the schema test, and none of this ships to users.
• The advisory covers 10.2.6 too; there's no fix on the 9.x or 10.x lines. The only patched version is 11.0.1 and later, and every consumer asks for ^9 or ^10, so npm can't get there without overrides.
• minimatch 11 is an API break. It removes makeRe(), Minimatch#regexp, matchOne() and AST, and set entries are no longer RegExps. A scan of the installed tree found glob 10 and 13 relying on exactly those (.makeRe, .matchOne, .regexp, instanceof RegExp), so overriding minimatch alone would leave glob broken.
• glob 14.0.3 is the release built on minimatch 11 (it depends on ^11.0.2). Its glob()/globSync() API is unchanged, and every glob consumer here (@opencode/util, @npmcli/map-workspaces, @npmcli/package-json, cacache, rimraf) calls only those. The direct minimatch users call only minimatch(), minimatch.match() and new Minimatch(), which 11 keeps.

So: "overrides": { "glob": "^14.0.3", "minimatch": "^11.0.2" }. The tree now has one copy of each (glob 14.0.3, minimatch 11.0.4).

AGENTS.md records the override and when to drop it: once @opencode/plugin resolves minimatch ≥ 11.0.1 itself. The two entries have to go together.

Verification

• npm audit: 0 vulnerabilities.
• npm test (typecheck + vitest): 355/355. npm run build passes; plugin.d.mts is 0.12 kB.
• Exercised the consumers against the overridden versions, since nothing in the suite runs them:
  • glob() and globSync({ ignore }) return the same file counts as ls;
  • opencode's own Glob.scan and Glob.match (@opencode/util) give correct results, including dot: true;
  • minimatch(), minimatch.match() and new Minimatch().match() behave correctly;
  • @npmcli/map-workspaces resolves.

chore(deps-dev): a dev-only change, so no release.

🤖 Generated with Claude Code

https://claude.ai/code/session_012aZHZ5fBse1HTCBF5yGdCw

[github-actions]

✅ Auto-review verdict: pass — Dev-only dependency override for glob and minimatch plus an AGENTS.md note; no runtime or source changes.

Reviewed commit e16599a.

---

No issues found. I read the diff and checked the lockfile.

• package.json adds overrides for glob (^14.0.3) and minimatch (^11.0.2). package-lock.json resolves glob 14.0.3 and minimatch 11.0.4, so the lock agrees with the overrides.
• The AGENTS.md note explains why the two packages move together and when to drop the overrides. This matches the repo's habit of documenting package.json decisions there.
• No source, protocol, prompt, token-handling or test changes. The tool/API contract is unchanged.

Open questions (not run, so not counted toward the verdict):

• Whether npm test passes under glob 14 and minimatch 11. I did not run a build or test.
• pnpm-lock.yaml and yarn.lock are tracked, but the PR does not touch them. AGENTS.md says the repo is npm-only, so I did not treat this as a finding.

Verdict: pass