[jeffkl]

Updates the runtime dependencies:

• glob: ^13.0.0 to ^14.0.5.
• @npmcli/package-json: ^8.0.0 to ^8.0.1, raising the minimum to the release that updates its own glob dependency to ^14.0.3.

The installed dependency tree resolves both the direct glob dependency and the one used by @npmcli/package-json to glob@14.0.5.

Changelog

glob 14

Summarized from glob's changelog at v14.0.5.

• Uses minimatch 11 with nonrecursive matchers instead of regular expressions, addressing pattern-driven ReDoS and aligning some edge cases more closely with Bash.
• Updates matcher APIs, removes debug, and adds Unicode normalization.
• Adjusts walker return types and improves ignore matching, Windows path handling, and traversal performance.
• Accepts readonly pattern and ignore arrays and stops traversal when an abort signal fires.

The 14.0.4 and 14.0.5 commits also update dependencies; see the comparison below for the complete changes.

@npmcli/package-json 8.0.1

Summarized from the 8.0.1 release notes.

• Updates glob from ^13.0.0 to ^14.0.3 (deps: bump glob from 13.0.0 to 14.0.3 package-json#190).
• Updates the development dependency @npmcli/template-oss from 5.1.0 to 5.1.1 (chore: bump @npmcli/template-oss from 5.1.0 to 5.1.1 package-json#186).

Commits

glob

Selected upstream commits from the 69 commits between v13.0.0 and v14.0.5:

• 7473a9c 14.0.5
• d8e1a60 update deps
• f26bdac 14.0.4
• 300eae3 minimatch@11.0.5
• fc93fd5 14.0.3
• 4682e8c fix: do not continue walking after signal abort

Full glob comparison.

@npmcli/package-json

All three commits between v8.0.0 and v8.0.1, newest first:

• c75aaa8 chore: release 8.0.1 (chore: release 8.0.1 package-json#191)
• 6bcfdc6 deps: bump glob from 13.0.0 to 14.0.3 (deps: bump glob from 13.0.0 to 14.0.3 package-json#190)
• a7dafdb chore: bump @npmcli/template-oss from 5.1.0 to 5.1.1 (chore: bump @npmcli/template-oss from 5.1.0 to 5.1.1 package-json#186)

Full @npmcli/package-json comparison.

Validation

Local validation on Windows:

• Confirmed @npmcli/package-json@8.0.1 and glob@14.0.5 are installed, with package-json's glob dependency deduplicated to the same 14.0.5 version.
• npm test passed its pretest ESLint and template checks. The test run reached 100% coverage but failed the ignore symlink workspace files case when Windows denied symlink fixture creation (EPERM).
• Repeated that case with the previous glob@13.0.0 and @npmcli/package-json@8.0.0: the same fixture creation failed with EPERM. Restored the updated versions afterward.
• Used a process-local Git configuration alias for origin pointing at the same repository as upstream, because template-oss branch discovery requires origin. No persistent remote configuration or generated files were changed.
• git diff --check passed.
• No lockfile change: this repository sets package-lock=false.