`@svgr/cli` pins `glob@^8.0.3`, which pulls a vulnerable `brace-expansion` (<=5.0.7, DoS via unbounded expansion). Fixed upstream in glob's own dependency chain once bumped to a version pulling `minimatch@^10.2.2` / `brace-expansion@^5.0.8`.
PR: bumps glob to `^13.0.6` and updates the two-line import to match glob's current named-export API. cc @gregberge
`@svgr/cli` pins `glob@^8.0.3`, which pulls a vulnerable `brace-expansion` (<=5.0.7, DoS via unbounded expansion). Fixed upstream in glob's own dependency chain once bumped to a version pulling `minimatch@^10.2.2` / `brace-expansion@^5.0.8`.
PR: bumps glob to `^13.0.6` and updates the two-line import to match glob's current named-export API. cc @gregberge