chore(deps): bump minimatch from 5.1.9 to 10.2.6

[dependabot]

Bumps minimatch from 5.1.9 to 10.2.6.

Changelog

Sourced from minimatch's changelog.

change log

10.2

• Add braceExpandMax option

10.1

• Add magicalBraces option for escape
• Fix makeRe when partial: true is set.
• Fix makeRe when pattern ends in a final ** path part.

10.0

• Require node 20 or 22 and higher

9.0

• No default export, only named exports.

8.0

• Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions
• Bump required Node.js version

7.4

• Add escape() method
• Add unescape() method
• Add Minimatch.hasMagic() method

7.3

• Add support for posix character classes in a unicode-aware way.

7.2

• Add windowsNoMagicRoot option

7.1

• Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

• ded1bbd 10.2.6
• 0215dfe update deps and lint
• 10968ea improve test for .. eating drive letters
• 693c823 10.2.5
• 7953af1 do not allow .. to consume drive letter on Windows
• 1caf918 lint and format
• 7783ed6 ignore docs
• 6d9b356 update deps etc
• c36addb 10.2.4
• 26b9002 docs: add warning about ReDoS
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Approved: the minimatch 10 named-export migration is covered and all current-head CI checks pass.

[Copilot]

🔵 Needs a closer look

Major-version dependency upgrades can introduce subtle runtime/tooling compatibility and compliance nuances that should be validated by a human reviewer.

Pull request overview

Updates the extension’s glob-matching dependency (minimatch) to a newer major version and adjusts the codebase to the package’s newer export style, while adding a small regression test around library-pattern deduplication.

Changes:

• Bump minimatch from ^5.1.9 to ^10.2.6 (plus lockfile updates) and update third-party notices for the new license.
• Update libraryController to use the named minimatch export and export dedupAlreadyCoveredPattern for reuse.
• Add a unit test validating deduplication behavior with a covered jar path.

File summaries

File	Description
ThirdPartyNotices.txt	Updates the minimatch notice text to the Blue Oak license.
package.json	Bumps minimatch dependency version.
package-lock.json	Locks minimatch@10.2.6 and updated transitive dependencies.
src/controllers/libraryController.ts	Switches to named minimatch import; exports dedupAlreadyCoveredPattern.
extension.bundle.ts	Re-exports dedupAlreadyCoveredPattern for test access.
test/suite/libraryController.test.ts	Adds coverage for deduping already-covered library patterns.

Review details

Suppressed comments (2)

ThirdPartyNotices.txt:506

• This notice includes a Markdown link target ("Notices") which is unlikely to be meaningful in a plain-text ThirdPartyNotices file; prefer plain text.

If anyone notifies you in writing that you have not
complied with [Notices](#notices), you can keep your
license by taking all practical steps to comply within 30
days after the notice. If you do not do so, your license

ThirdPartyNotices.txt:524

• This license text uses Markdown emphasis markers (...). Since ThirdPartyNotices.txt is plain text, remove the markup to avoid copying formatted artifacts into the notice.

**_As far as the law allows, this software comes as is,
without any warranty or condition, and no contributor
will be liable to anyone for any damages related to this
software or this license, under any kind of legal claim._**

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It’s a major-version dependency upgrade with changed module export semantics and supply-chain considerations that warrants a final human verification pass.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Changyong Gong (chagong)]

Approved: the minimatch 10 migration, minimum VS Code runtime, license notice, focused tests, packaging, independent review, and final-head CI checks all pass.