Snyk Valnarability in glob 10..4.5

[shijumon]

please upgrade glob version to glob@11.1.0 to fix the vularabilty

[github-actions]

Hello there shijumon 👋

Thank you for opening your very first issue in this project.

We will try to get back to you as soon as we can.👀

[WoH]

What's the exploitable code path here? Or is this just security theatre to satisfy a linter

[Xandynhu]

Hi,

From what I understand and currently have access to:

1. The glob package on version 10.5.0 should already be a sufficient fix for the vulnerability. Suggested by the official advisory notes.
2. On my build @tsoa/cli version 6.6.0 defines glob usage as "glob": "^10.3.10" and my static code scan points the usage of glob version 10.4.5, both of which should already be enough for patching the vulnerability when being mapped to "10.5.0".
3. Maybe the linter does not check for overridden packages and thus, in this case, the change would be to "just satisfy the linter" - which I assume that should still be a valid reason to reduce complexity.

Is there a reason why keeping the outdated version would be a better option?
Am I missing something else that might be important here?