[gnacho]

What this fixes

Dependabot alert 37: minimatch < 11.0.1 has a denial of service via globparts amplification (medium severity). The advisory has no patch release in the 10.x line, the fix landed in 11.0.1, and minimatch is not a direct dependency: it arrives through eslint, @eslint/config-array, @typescript-eslint/typescript-estree and glob, all of which still request ^10.2.x. That is why Dependabot cannot open its own PR for it.

Change

• app/package.json: add an overrides block forcing minimatch to ^11.0.3 (latest). The lockfile now contains a single copy, 11.0.3, replacing 10.2.6.
• Nothing else moves. minimatch is a development-scope dependency (lint tooling and workbox-build premanifest), it never ships in the bundle, and v11 declares node 18 || 20 || >=22, so the repo's Node 24 CI is fine.

Verification

• npm audit no longer lists the minimatch advisory.
• npm run lint passes with 0 errors (8 pre-existing warnings), which exercises eslint, @typescript-eslint and their glob handling against minimatch 11.
• npm run build passes (tsc -b && vite build), which exercises the workbox-build path that also pulls a minimatch.
• The lockfile check confirms exactly one minimatch in the tree and it is 11.0.3.

The remaining npm audit findings (deepmerge, glob and two others) are pre-existing, unrelated to this advisory and left untouched on purpose.

Closes #1720