Bump minimatch from 3.1.2 to 3.1.5 in /src/boilerplates/vue/chi-vue-boilerplate

[dependabot]

Bumps minimatch from 3.1.2 to 3.1.5.

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Routine patch bump of minimatch (3.1.2→3.1.5) with no in-repo usage and no applicable advisories; escalated solely because critical CI health is below threshold repo-wide (pass rate 64.3%).

TL;DR

• Merge: 🔍 review, then merge — the dependency itself is safe; the only blocker is pre-existing CI failures unrelated to this PR.
• Breaks your code? ✅ Most likely not — minimatch has zero import sites in this repo.
• Security? ✅ no applicable advisories — 5 known advisories exist for minimatch but none affect v3.1.5.
• Update: minimatch — you have 3.1.2, this PR installs 3.1.5 (patch, spans 3 releases). Routine patch refresh; no code impact.

Signal	Value	Interpretation
Bump type	patch	Semver patch increment (3.1.2→3.1.5); by convention, backward-compatible bug fixes only — no new public API surface, no breaking changes expected.
Dependency risk	low	Patch bump with zero in-repo import sites (minimatch is a transitive lock-file entry, not imported in source). No breaking changes to assess. Merging will not affect application code.
Security risk	low	No known advisories still affect v3.1.5. Five advisories were returned for minimatch: three target the v10.x branch (vulnerable range >=10.0.0) — inapplicable to v3.1.5; two (GHSA-f8q6-p94x-37v3, GHSA-hxm2-r34f-qmc5) cover <3.0.5 / <3.0.2 — already patched before the current v3.1.2. This bump makes no change on the security axis.
CI health risk	high	28 critical runs observed on master; pass rate 64.3% (below the 70% medium threshold), flakiness 0% → ci_confidence: low. The core "Push on master" workflow is 9/9 (100%), but multiple other Dependabot update workflows are failing and classified as critical/ambiguous-critical, dragging the aggregate below threshold. No informational workflows excluded. This is a pre-existing repo-wide issue, not caused by this PR.
API usage in repo	false	Complete scan across all source files — patterns tried: from 'minimatch', require('minimatch'), import('minimatch'), export … from 'minimatch'. Zero hits. minimatch is a transitive dependency and not imported anywhere in the repo source.
Cross-repo signal	standalone	No publishable root manifest found — this repo does not produce a library package consumed by other repos.
Data completeness	degraded	4/5 signals obtained. Missing: release_notes — changelog was not retrievable for this range (assessed via semver delta instead; patch classification makes this low-risk). All other signals (classification, api_usage, ci_health, cascade) are complete.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low — the routing table unconditionally escalates when ci_confidence = low, regardless of how safe the dependency itself is.

Escalation category: ci-health — the dependency risk is low, security risk is low; the sole trigger is the repo's pre-existing CI pass rate of 64.3% falling below the minimum medium threshold. This PR did not cause the CI failures.

Confidence breakdown — score: 0.75. List of factors:

• ✅ Patch bump — lowest possible semver delta, no breaking-change risk by convention.

• ✅ Zero in-repo usage — minimatch is not imported anywhere; blast radius is zero.

• ✅ No applicable advisories — all 5 known advisories are inapplicable to v3.1.5.

• ✅ No cascade conflicts — no other open Dependabot PRs conflict with this one.

• ✅ Standalone cross-repo signal — no downstream consumers at risk.

• ⚠️ Release notes unavailable (−0.10) — changelog for 3.1.2→3.1.5 was not retrieved; assessed via semver delta only. For a patch bump with zero usage this is low-consequence.

• ⚠️ Critical CI low (−0.15) — repo-wide pass rate 64.3%; escalation is process-driven, not risk-driven.

• 💡 To reach a lower route: Fix the pre-existing CI failures on master so the critical-check pass rate rises to ≥70% (medium) — at which point this PR would route to spot_check, and ≥90% with ≤10% flakiness to auto_eligible. Fixing informational workflows (e.g. Dependency Submission, Copilot Code Review) will not change the route, as they are already excluded from CI health scoring. The dependency and security signals are already clear.

What AiFEL checked

1. Triage — classified patch (minimatch 3.1.2→3.1.5, npm, src/boilerplates/vue/chi-vue-boilerplate/package-lock.json).
2. Symbol extraction — 0 import sites across 0 files; complete scan, confirmed unused in repo source.
3. Release-notes comparator — changelog not available for this range; patch semver classification applied. No breaking changes expected.
4. CI health — 28 critical runs: pass 64.3%, flaky 0% → confidence low; no informational workflows excluded.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 4/5 signals; missing: release_notes (changelog not retrievable).

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. minimatch is a transitive dependency with zero import sites in the repo source, so no application code is exposed to this version change.

Security advisories

✅ Nothing still affects 3.1.5

Five advisories were returned for minimatch; none apply to v3.1.5:

• GHSA-7r86-cg39-jmmj (CVE-2026-27903) · CVSS 7.5 · affects >=10.0.0, <10.2.3 — v3.1.5 is on the v3.x branch; not applicable.
• GHSA-23c5-xmqv-rm74 (CVE-2026-27904) · CVSS 7.5 · affects >=10.0.0, <10.2.3 — same, not applicable to v3.x.
• GHSA-3ppc-4f35-3m26 (CVE-2026-26996) · CVSS not specified · affects >=10.0.0, <10.2.1 — not applicable to v3.x.
• GHSA-f8q6-p94x-37v3 (CVE-2022-3517) · CVSS 7.5 · affects <3.0.5; first patched 3.0.5 — v3.1.2 (the current version) already exceeds this; neither old nor new version is affected.
• GHSA-hxm2-r34f-qmc5 (CVE-2016-10540) · CVSS 7.5 · affects <3.0.2; first patched 3.0.2 — already patched before v3.1.2; not affected.

Clear on the security axis — no action needed.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	minimatch	3.1.2	3.1.5	routine patch — no code impact; no advisories resolved or introduced

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "degraded",
  "escalate_reason": "risk",
  "missing_signals": [
    {
      "signal": "release_notes",
      "reason": "changelog not retrievable for the 3.1.2→3.1.5 range; assessed via semver delta and zero-usage confirmation instead"
    }
  ],
  "confidence": 0.75,
  "packages": [
    {
      "ecosystem": "npm",
      "name": "minimatch",
      "old_version": "3.1.2",
      "new_version": "3.1.5"
    }
  ],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Routine patch bump of minimatch (3.1.2→3.1.5); zero in-repo usage, no applicable advisories; escalated solely on pre-existing repo-wide CI health (pass rate 64.3%, ci_confidence low).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-1971",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience