fix(deps): mocha-scoped atomic minimatch override — unblocks mocha 11 (#9) without regressing Alert #7

[rz1989s]

What

Both minimatch security pins move into one nested block under mocha in package.json overrides:

"mocha": {
  "glob": { "minimatch": "^3.1.3" },
  "minimatch": "^4.2.5"
}

Resolved tree and package-lock.json are byte-identical to master (verified: npm install reports up-to-date; npm ci + npm ls clean). docs/security/DEPENDENCY-AUDIT.md gains the Alert #7/#10 supersession addendum with the full advisory family and the #9 merge protocol.

Why (ground truth, verified 2026-09-24)

Alert #7's fix cannot be removed before the mocha bump. mocha@9.2.2 exact-pins minimatch: "4.2.1" in its own manifest (registry-verified) — it cannot float to a patched release. Removing the pin while mocha 9 is installed re-opens Alert #7 on main: 4.2.1 sits inside the 2026 ReDoS family's 4.x ranges — GHSA-3ppc-4f35-3m26 / CVE-2026-26996 (fixed 4.2.4), GHSA-7r86-cg39-jmmj / CVE-2026-27903 and GHSA-23c5-xmqv-rm74 / CVE-2026-27904 (fixed 4.2.5); historical 3.x coverage: GHSA-f8q6-p94x-37v3 / CVE-2022-3517 (fixed 3.0.5). The current pinned resolution 4.2.6 is ≥ every 4.x fixed version.

The pins are bump-coupled, so they are now one atomic unit. npm applies nested overrides to every matching edge in the parent's subtree — demonstrated two ways:

• Removing the top-level glob pin while keeping mocha.minimatch leaves npm ls reporting minimatch@3.1.5 invalid: "^4.2.5" from node_modules/glob — the next honest regen would force 4.2.6 into glob@7. The 3.x pin can only be deleted together with the 4.x pin.
• Dependabot's own chore(deps-dev): bump mocha from 9.2.2 to 11.7.6 #9 lockfile regen proved the post-bump hazard of the old layout: glob@10.5.0 received minimatch 3.1.5 and mocha@11.7.6's declared minimatch: ^9.0.5 was forced down to 4.2.6, crashing every spec-resolving mocha invocation — TypeError: (intermediate value).hasMagic is not a function at glob/dist/commonjs/has-magic.js:21 via mocha/lib/cli/lookup-files.js:78 (reproduced locally on the chore(deps-dev): bump mocha from 9.2.2 to 11.7.6 #9 branch).

Supersession at mocha 11.7.6 (registry manifest): declares minimatch: ^9.0.5 directly plus glob: ^10.4.5 (→ minimatch ^9.0.1). Fresh resolve = 9.0.9 ≥ 9.0.7 — patched across the entire family. Post-bump, no minimatch override is needed and any surviving one breaks glob@10.

Verification

Branch state (mocha 9, pre-bump — protection unchanged):

• npm ci clean; npm ls minimatch glob → mocha → minimatch@4.2.6, glob@7.2.0 → minimatch@3.1.5 (identical to master)
• npm audit → zero minimatch advisories; 13 findings, all pre-existing and identical to master (brace-expansion/diff/js-yaml/nanoid via mocha@9, stream-json/toml/uuid via jayson/@anchor-lang chains)
• npx tsc --noEmit → only the 2 documented pre-existing TS2307s
• npx mocha (node 22, spec collection) → runs to completion

End-state simulation (throwaway local regen of master + mocha ^11.7.6 + atomic deletion of the mocha overrides block — not pushed):

• npm ci clean; npm ls minimatch → single minimatch@9.0.9 (deduped across mocha 11.8.0 + glob@10.5.0)
• npm audit → zero minimatch advisories; mocha@9-subtree findings clear (13 → 10: brace-expansion/js-yaml/nanoid gone — tree resolves js-yaml@4.3.2, brace-expansion@2.1.7; remaining: diff 6.0.0–8.0.2 via mocha 11's jsdiff 7, plus stream-json/toml/uuid via mocha-independent chains)
• npx mocha → 11.8.0, spec collection completes — the chore(deps-dev): bump mocha from 9.2.2 to 11.7.6 #9 reproducer passes

#9 unblock path (do NOT @dependabot rebase — its regen re-creates the broken pairing)

After this PR merges, on dependabot/npm_and_yarn/mocha-11.7.6:

1. git fetch origin && git checkout dependabot/npm_and_yarn/mocha-11.7.6
2. git merge origin/master — resolve package.json to main's content plus "mocha": "^11.7.6", with the entire mocha overrides block deleted (atomic removal of both minimatch pins)
3. Honest regen from the merged manifest: rm -rf node_modules package-lock.json && npx -y npm@10 install (a lockfile-only install silently no-ops)
4. Gate: npm ci && npm ls minimatch && npm audit — expect a single minimatch@9.x and zero minimatch advisories
5. Push, CI-gate (npm ci + cargo check), then merge chore(deps-dev): bump mocha from 9.2.2 to 11.7.6 #9

Full details: docs/security/DEPENDENCY-AUDIT.md → "Alert #7 / #10 addendum".

⚠️ Per the own-PR rule this stays unmerged pending RECTOR review. #9 stays open and untouched.