[Snyk] Security upgrade glob from 7.2.3 to 12.0.0

[MaxMood96]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/dependency-extraction-webpack-plugin/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[MaxMood96]

This is a very significant major version upgrade from v7 to v12, which includes a complete rewrite of the library and introduces numerous breaking changes. Code modifications are required for this upgrade.

Key Breaking Changes:

• Promise-Based API: The most critical change is the move from a callback-based API to a modern Promise-based API starting in v9.0. Asynchronous operations now return Promises, and the old callback pattern is no longer supported.
• Node.js Requirement: Support for older Node.js versions has been dropped. Version 9 and higher require Node.js v16 or newer.
• Path Separators (Windows): Backslashes (\) are no longer treated as path separators in glob patterns; they are now exclusively used for escaping characters. All patterns, including on Windows, must use forward-slashes (/).
• Module Exports: The package no longer has a default export. You must use named imports, for example: const { glob } = require('glob');.
• Removed Options: Many options from v7 have been removed in v8.0, including silent, strict, nonull, nounique, and nosort. The behavior associated with these options (like ensuring unique results) is now standard.

Recommendation:
Due to the complete API rewrite, this upgrade requires careful code refactoring. You must update all glob calls to use the new Promise-based syntax and ensure your patterns use forward-slashes. Thorough testing is essential.

Source: GitHub Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @snyk-bot, @MaxMood96, @mergify.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: snyk-bot, MaxMood96, mergify.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.