fix: bump minimatch from 3.0.4 to 3.1.5 in /todo

[dependabot]

Bumps minimatch from 3.0.4 to 3.1.5.

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Summary by CodeRabbit

• Chores
  • Updated package dependencies to latest stable versions
  • Refreshed package metadata and lock file entries
  • Enhanced build configuration consistency

[mtrezza]

@coderabbitai review

[mtrezza]

Approved: transitive dependency security patch. minimatch 3.0.4 -> 3.1.5 addresses ReDoS vulnerability (CVE-2022-3517). Lock-file only change, low risk.

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cdc3106e-ab11-4657-a2cb-441f349dc0e8

📥 Commits

Reviewing files that changed from the base of the PR and between b8c014f and 59f3b5b.

⛔ Files ignored due to path filters (1)

• todo/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• todo/package-lock.json

---

📝 Walkthrough

Walkthrough

The package-lock.json file was updated to remove the peer flag from six package entries and update the minimatch dependency from version 3.0.4 to 3.1.5 with new resolved and integrity values.

Changes

Cohort / File(s)	Summary
Package Lock Updates todo/package-lock.json	Removed "peer": true from ajv@6.5.3, babel-core@6.26.3, graphql@0.13.2, pg@7.4.3, react@16.4.2, and webpack@4.17.1. Updated minimatch from 3.0.4 to 3.1.5 with new resolved/integrity values and added "license": "ISC".

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/npm_and_yarn/todo/minimatch-3.1.5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}