chore: update minimatch

[benlife5]

https://yext.atlassian.net/browse/VULN-42320

[coderabbitai]

Walkthrough

This pull request updates development and tooling metadata. In packages/pages/package.json the devDependency minimatch is bumped (from ^9.0.3 to ^10.2.2) and the devDependency @types/minimatch is removed. The THIRD-PARTY-NOTICES file is edited to update a listed minimatch version (9.0.3 → 9.0.5). The repository lint-staged configuration is adjusted to exclude THIRD-PARTY-NOTICES from the oxfmt formatter.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: updating the minimatch dependency.
Description check	✅ Passed	The description references a JIRA vulnerability issue (VULN-42320), which relates to the minimatch update in the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch update-minimatch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/pages/package.json`:
- Line 103: Remove the redundant `@types/minimatch` entry from lockfiles and
package manifests (it conflicts with minimatch v10's built-in types) and run a
fresh install to update lockfile; then audit imports (e.g., the test file
packages/pages/src/common/src/function/internal/getFunctionFilepaths.test.ts and
any other modules) to ensure minimatch is only imported using ESM-style imports
(import { minimatch }) and not required via CommonJS, and if any CommonJS
consumers remain or you're constrained to CJS, either pin brace-expansion to a
compatible non-ESM version or add a dependency resolution/override to force a
compatible brace-expansion version so minimatch@10 works in your environment.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bc4627a and 5abfdd6.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• packages/pages/package.json

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 55: Replace the undocumented negation prefix used in package.json
("!**/THIRD-PARTY-NOTICES") with the documented micromatch extglob form
"!(**/THIRD-PARTY-NOTICES)" in the lint-staged config; update the pattern string
in the package.json entry so lint-staged sees the extglob negation, and verify
that the change in path structure (presence of a slash) does not inadvertently
disable matchBase behavior—if you need basename matching instead of full-path
matching, adjust the pattern accordingly (e.g., remove the slash or use an
alternate glob) to preserve original matching semantics.

In `@THIRD-PARTY-NOTICES`:
- Around line 8722-8725: THIRD-PARTY-NOTICES currently lists minimatch@9.0.5 but
package.json and the lockfile resolve to minimatch@10.2.2; regenerate the
THIRD-PARTY-NOTICES file from the project's lockfile (e.g., package-lock.json /
yarn.lock / pnpm-lock.yaml) or rerun the license-notice generation script used
in this repo so the entry for minimatch (and any other packages) matches the
resolved versions in the lockfile and the package.json specification.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5abfdd6 and 1551211.

📒 Files selected for processing (2)

• THIRD-PARTY-NOTICES
• package.json

[mkilpatrick]

rabbit comments

[benlife5]

minimatch v9.0.5 is bundled because glob is a dependency. The latest version of glob still uses minimatch v9.0.5 so I think glob (and some other packages) will need to update minimatch before the NOTICES file updates. Our direct installation is a devDependency, so it's license info doesn't get written to NOTICES