security: upgrade minimatch dependency to fix ReDoS vulnerabilities (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74)

[ainthek]

Security: minimatch ReDoS Vulnerabilities

grasp@0.6.0 pins minimatch: "^3.0.3" which resolves to minimatch@3.1.2 — a version affected by multiple ReDoS (Regular Expression Denial of Service) vulnerabilities.

Affected advisories

Advisory	Description
GHSA-3ppc-4f35-3m26	ReDoS via repeated wildcards with non-matching literal in pattern
GHSA-7r86-cg39-jmmj	ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
GHSA-23c5-xmqv-rm74	ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Dependency chain

grasp@0.6.0
└── minimatch@"^3.0.3" → resolves to 3.1.2 (vulnerable <=3.1.3)

Fix

Upgrade minimatch to >=3.1.5 in package.json:

"minimatch": "^3.1.5"

The fix is a non-breaking patch/minor bump — no API changes.

Workaround for consumers

Until this is fixed upstream, consumers can add an overrides block in their own package.json:

"overrides": {
  "minimatch": ">=3.1.5"
}

---

This issue was: Generated/modified by AI RooCode 3.53.0, used model google/claude-sonnet-4-6