fix(security): resolve high severity minimatch vulnerabilities

[github-actions]

Summary

This PR fixes 3 high severity vulnerabilities identified by Snyk in the minimatch dependency:

• SNYK-JS-MINIMATCH-15309438: Regular Expression Denial of Service (ReDoS)
• SNYK-JS-MINIMATCH-15353387: Regular Expression Denial of Service (ReDoS)
• SNYK-JS-MINIMATCH-15353389: Inefficient Algorithmic Complexity

Problem

The vulnerable minimatch@9.0.5 was introduced as a transitive dependency through:

@sentry/profiling-node > @sentry/node > minimatch@9.0.5

Solution

Added an npm overrides section in package.json to force all instances of minimatch < 9.0.7 to use ^9.0.7, which contains the security fixes.

Verification

After applying the fix, running npx snyk test confirms that the high severity vulnerabilities are resolved:

• Before: 3 high severity issues
• After: 0 high severity issues (only medium license issues remain)

---

Generated with Continue

---

Continue Tasks: ✅ 7 no changes — View all

---

Summary by cubic

Forces minimatch to a patched version via npm overrides to fix three high-severity Snyk vulnerabilities. Snyk now reports 0 high severity issues; the vulnerable transitive minimatch@9.0.5 from @sentry/node is removed.

• Dependencies
  • Added overrides in extensions/cli/package.json: minimatch@<9.0.7 → ^9.0.7 (resolves to 9.0.9).
  • Regenerated package-lock.json to apply minimatch 9.0.9 and updated brace-expansion across nested deps.

^{Written for commit 2f0b006. Summary will update on new commits.}

[continue]

Docs Review

No documentation updates needed for this PR.

This is an internal security maintenance change that updates minimatch to resolve high-severity vulnerabilities. The changes are limited to:

• package-lock.json dependency version updates
• package.json npm overrides configuration

These changes don't affect any public APIs, user-facing features, or configuration options, so no documentation updates are required.

[cubic-dev-ai]

No issues found across 2 files