Update minimatch from 10.0.3 to 10.1.2 to address GHSA-7h2j-956f-4vf2

[EvilFaeton]

Summary

Updates the minimatch dependency from 10.0.3 to 10.1.2 across the monorepo to address a Regular Expression Denial of Service (ReDoS) vulnerability in the underlying brace-expansion dependency.

Security Advisory: GHSA-7h2j-956f-4vf2

Details

Updated minimatch in the following packages:

• @microsoft/api-extractor
• @rushstack/package-extractor
• @rushstack/webpack4-localization-plugin
• common-versions.json (preferred version)

Changes in minimatch 10.0.3 → 10.1.2:

• Add magicalBraces option for escape function
• Fix makeRe when partial: true is set
• Fix makeRe when pattern ends in final ** path part

Breaking changes: None. The API usage in the affected packages only uses the basic minimatch(string, pattern) function, which remains unchanged.

How it was tested

• Ran rush update successfully
• Built all affected packages (rush build -t @microsoft/api-extractor -t @rushstack/package-extractor -t @rushstack/webpack4-localization-plugin) - 32 operations succeeded
• Ran api-extractor tests - 61 tests passed
• Ran package-extractor tests - 12 tests passed

[EvilFaeton]

@microsoft-github-policy-service agree