[vCaisim]

Why

@currents/cmd depends on globby, which pulls in braces. braces has a high-severity advisory (GHSA-vfj7-8cjw-p6xm) with no fixed version, and the latest globby still depends on it, so customers' scanners flag cmd.

Part of ENG-1888

What changed

• globby is replaced by tinyglobby, which does not use braces.
• The two callers, --input-file (convert, run upload) and cache set (--path, --preset last-run), use globPaths() in src/lib/glob.ts. It runs tinyglobby for each pattern:
  • absolute patterns return absolute paths
  • !patterns are passed to tinyglobby's ignore
  • each pattern's matches are sorted
  • numeric ranges like {1..10} are written out as lists. On its own, tinyglobby reads {1..10} as the character class [1-10].
• A clean install has no braces, and npm audit --omit=dev reports 0 vulnerabilities, down from 5 high.

For patterns without !, the same files are matched as with 2.3.0. The differences:

• Order within a pattern is sorted. globby followed the file system, shallower files first. This only matters when two matched reports hold the same spec, because convert keeps the one it reads last.
• !patterns apply to every pattern, and one that matches a folder name skips that folder. globby applied them only to the patterns before them, and only to files.
• A folder that can't be read is skipped. globby failed with EACCES.
• An empty pattern, such as one left by a trailing comma, matches nothing. globby matched every file in the current folder.
• A ./ prefix is dropped from matched paths: ./reports/a.xml comes back as reports/a.xml.

Testing

Steps 2–4 ran on Windows, Linux and macOS, with Node 20, 22 and 24, and with npm, pnpm and yarn installs.

1. Unit tests: the cmd suite passes, with tests for each globPaths() rule, including the order and !pattern behavior above.
2. Same files as globby 11.1.0: both returned the same files for 60 fixed patterns, 29 brace-range patterns, and 12,000 random folder trees and patterns per OS.
3. Installed CLIs, side by side: the published 2.3.0 and the packed branch ran the same 27 convert, cache set and cache get commands, with the cache commands against a local mock API.
   • Exit codes, matched files and cache archives were identical.
   • Converted reports were identical too, except in the one case whose fixture holds two reports per spec. There, the same files are read in another order.
4. Real use against the Currents API, with both versions:
   • convert and run upload of JUnit reports found with --input-file 'reports/**/*.xml' produced the same output.
   • cache set --preset last-run after a Playwright run with one failing test, then cache get on a second attempt: --last-failed reran only that test.
   • cache set/get --path restored the report folder byte for byte.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Replace globby with tinyglobby in the CLI’s report and cache path resolution to remove the vulnerable braces dependency. Add globPaths handling for absolute paths, exclusions, sorting, brace ranges, and safe large-range limits while preserving command behavior and eliminating runtime audit findings.

Topics

Topic	Details
Flow compatibility tests	Verify report conversion and cache flows across relative, absolute, negated, brace, range, empty, and deeply nested patterns, including platform-safe path assertions. Modified files (3) packages/cmd/src/lib/__tests__/glob.test.ts packages/cmd/src/services/cache/__tests__/path.spec.ts packages/cmd/src/test-utils/path.ts Latest Contributors(2) User Commit Date slavic@currents.dev test(cmd): cover negat... October 22, 2026 agoldis@gmail.com fix(cmd): do not save ... October 02, 2026
Safe glob matching	Replace globby with tinyglobby across convert input discovery and cache path lookup, centralizing matching in globPaths with compatible exclusions, ordering, absolute paths, and numeric-range expansion. Modified files (5) package-lock.json packages/cmd/package.json packages/cmd/src/commands/convert/options.ts packages/cmd/src/lib/glob.ts packages/cmd/src/services/cache/path.ts Latest Contributors(2) User Commit Date slavic@currents.dev chore(cmd): keep relea... October 22, 2026 miguelangaranocurrents docs(examples): apply ... October 16, 2026

---

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}

Baz withdrew its approval because this pull request is no longer ready to merge.