Bump minimatch from 3.0.4 to 3.1.2

[kachkaev]

Closes #179

[aloisklink]

This also closes #165

Maintainers, is it possible to instead use caret ranges, e.g. ^3.1.2 instead of pinning dependencies?

That way, if there is a security vulnerability in this package (or in serve), you guys don't need to manually update this package.

[kachkaev]

As far as I understand, Vercel folks prefer pinning dependencies in their products. Here is Next.js, for example:
package.json#L76-L83 (caniuse-lite is an exception because it tracks recent browser releases).

This way they save their users from accidental upstream breaking changes within a semver range. Not sure this approach can be revisited easily, so I doubt we’ll be able to introduce ^ or ~ in this PR 😅

[imki123]

I need to merge this PR.

[bnussman]

@vercel, can you give this PR some attention? 🥺

[AndyBitz]

Thank you for opening the issue and providing a PR 🥇