From 0fa547e9969c761c72478856f16c98001d601af1 Mon Sep 17 00:00:00 2001 From: renantatsuo Date: Sat, 31 Oct 2026 11:08:34 +0000 Subject: [PATCH 1/6] fix(bundler-plugins): Bump glob to 14.0.3 Fixes GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch, pulled in at ^11 by glob 14). --- packages/bundler-plugins/package.json | 2 +- pnpm-lock.yaml | 45 +++++++++++++++++++++++++-- 2 files changed, 44 insertions(+), 3 deletions(-) diff --git a/packages/bundler-plugins/package.json b/packages/bundler-plugins/package.json index 3bb53c945278..60df96e18f71 100644 --- a/packages/bundler-plugins/package.json +++ b/packages/bundler-plugins/package.json @@ -117,7 +117,7 @@ "dependencies": { "@sentry/core": "11.10.0", "dotenv": "^17.4.2", - "glob": "^13.0.6", + "glob": "^14.0.3", "magic-string": "~0.30.8 || ^1.0.0", "oxc-parser": "^0.152.0", "sentry": "^0.45.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6ac487eaedde..89b254380515 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1163,8 +1163,8 @@ importers: specifier: ^17.4.2 version: 17.4.2 glob: - specifier: ^13.0.6 - version: 13.0.6 + specifier: ^14.0.3 + version: 14.0.3 magic-string: specifier: ~0.30.8 || ^1.0.0 version: 0.30.21 @@ -5805,6 +5805,9 @@ packages: resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} engines: {node: '>=18.0.0'} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@istanbuljs/load-nyc-config@1.1.0': resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==} engines: {node: '>=8'} @@ -10169,6 +10172,10 @@ packages: brace-expansion@2.1.7: resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} + engines: {node: 20 || >=22} + brace-expansion@5.0.8: resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} engines: {node: 20 || >=22} @@ -12566,6 +12573,10 @@ packages: resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} engines: {node: 18 || 20 || >=22} + glob@14.0.3: + resolution: {integrity: sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==} + engines: {node: 18 || 20 || >=22} + glob@5.0.15: resolution: {integrity: sha512-c9IPMazfRITpmAAKi22dK1VKxGDX9ehhqfABDriL/lzO92xcUKEJPQHrVA/2YHSNFB4iFlykVmWvwo48nr3OxA==} deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me @@ -14422,6 +14433,10 @@ packages: resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==} engines: {node: 18 || 20 || >=22} + minimatch@11.0.3: + resolution: {integrity: sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==} + engines: {node: 18 || 20 || >=22} + minimatch@3.1.5: resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} @@ -15601,6 +15616,10 @@ packages: resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} engines: {node: 18 || 20 || >=22} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} + engines: {node: 18 || 20 || >=22} + path-to-regexp@0.1.12: resolution: {integrity: sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==} @@ -24073,6 +24092,8 @@ snapshots: dependencies: minipass: 7.1.3 + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@istanbuljs/load-nyc-config@1.1.0': dependencies: camelcase: 5.3.1 @@ -29097,6 +29118,10 @@ snapshots: dependencies: balanced-match: 1.0.2 + brace-expansion@5.0.12: + dependencies: + balanced-match: 4.0.3 + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.3 @@ -31977,6 +32002,12 @@ snapshots: minipass: 7.1.3 path-scurry: 2.0.2 + glob@14.0.3: + dependencies: + minimatch: 11.0.3 + minipass: 7.1.3 + path-scurry: 3.0.0 + glob@5.0.15: dependencies: inflight: 1.0.6 @@ -34310,6 +34341,11 @@ snapshots: dependencies: brace-expansion: 5.0.8 + minimatch@11.0.3: + dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 + brace-expansion: 5.0.12 + minimatch@3.1.5: dependencies: brace-expansion: 1.1.21 @@ -36244,6 +36280,11 @@ snapshots: lru-cache: 11.4.0 minipass: 7.1.3 + path-scurry@3.0.0: + dependencies: + lru-cache: 11.4.0 + minipass: 7.1.3 + path-to-regexp@0.1.12: {} path-to-regexp@1.9.0: From 2b47536cc3ee1a2106594559f2499872dfa13379 Mon Sep 17 00:00:00 2001 From: renantatsuo Date: Sat, 31 Oct 2026 11:08:42 +0000 Subject: [PATCH 2/6] fix(react-router): Bump glob to 14.0.3 Fixes GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch, pulled in at ^11 by glob 14). --- packages/react-router/package.json | 2 +- pnpm-lock.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/react-router/package.json b/packages/react-router/package.json index 07d576d599b0..17a181df5114 100644 --- a/packages/react-router/package.json +++ b/packages/react-router/package.json @@ -64,7 +64,7 @@ "@sentry/server-runtime-injection": "11.10.0", "@sentry/server-utils": "11.10.0", "@sentry/bundler-plugins": "11.10.0", - "glob": "^13.0.6", + "glob": "^14.0.3", "sentry": "^0.44.0" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 89b254380515..2a91780c902f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1978,8 +1978,8 @@ importers: specifier: 11.10.0 version: link:../server-utils glob: - specifier: ^13.0.6 - version: 13.0.6 + specifier: ^14.0.3 + version: 14.0.3 sentry: specifier: ^0.44.0 version: 0.44.0 From 7ca92a743cc589bbb003c516df4edb3da703b969 Mon Sep 17 00:00:00 2001 From: Nicolas Hrubec Date: Sat, 31 Oct 2026 12:37:02 +0100 Subject: [PATCH 3/6] refactor(react-router): Reuse shared glob helper Co-Authored-By: GPT-6 --- .../react-router-sourcemaps/assert-build.ts | 8 ++++++++ packages/react-router/package.json | 1 - .../src/vite/buildEnd/handleOnBuildEnd.ts | 7 ++----- .../vite/buildEnd/handleOnBuildEnd.test.ts | 20 +++++++------------ pnpm-lock.yaml | 3 --- 5 files changed, 17 insertions(+), 22 deletions(-) diff --git a/dev-packages/e2e-tests/test-applications/react-router-sourcemaps/assert-build.ts b/dev-packages/e2e-tests/test-applications/react-router-sourcemaps/assert-build.ts index 2bc4986220d4..ca6acfb5a6aa 100644 --- a/dev-packages/e2e-tests/test-applications/react-router-sourcemaps/assert-build.ts +++ b/dev-packages/e2e-tests/test-applications/react-router-sourcemaps/assert-build.ts @@ -111,4 +111,12 @@ for (const chunk of chunks) { assert.ok(crossCheckedChunks > 0, 'Expected at least one uploaded chunk to cross-check debug IDs against'); console.log(`${crossCheckedChunks} chunk(s) ship a debug ID that was uploaded\n`); +const remainingClientMaps = fs + .readdirSync(CLIENT_ASSETS_DIR, { recursive: true }) + .filter(file => file.endsWith('.map')); +assert.deepEqual(remainingClientMaps, [], 'Expected client source maps to be deleted after upload'); + +const remainingServerMaps = fs.readdirSync('build/server', { recursive: true }).filter(file => file.endsWith('.map')); +assert.ok(remainingServerMaps.length > 0, 'Expected server source maps outside the deletion pattern to be preserved'); + console.log('All react-router source map assertions passed!'); diff --git a/packages/react-router/package.json b/packages/react-router/package.json index 17a181df5114..a97bb7ee240e 100644 --- a/packages/react-router/package.json +++ b/packages/react-router/package.json @@ -64,7 +64,6 @@ "@sentry/server-runtime-injection": "11.10.0", "@sentry/server-utils": "11.10.0", "@sentry/bundler-plugins": "11.10.0", - "glob": "^14.0.3", "sentry": "^0.44.0" }, "devDependencies": { diff --git a/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts b/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts index a4cf0403e248..79d413c99861 100644 --- a/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts +++ b/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts @@ -1,8 +1,8 @@ import { rm } from 'node:fs/promises'; import type { Config } from '@react-router/dev/config'; import { createSentrySDK } from 'sentry'; +import { globFiles } from '@sentry/bundler-plugins/core'; import type { SentryVitePluginOptions } from '@sentry/bundler-plugins/vite'; -import { glob } from 'glob'; import type { SentryReactRouterBuildOptions } from '../types'; type BuildEndHook = NonNullable; @@ -134,10 +134,7 @@ export const sentryOnBuildEnd: BuildEndHook = async ({ reactRouterConfig, viteCo } if (updatedFilesToDeleteAfterUpload) { try { - const filePathsToDelete = await glob(updatedFilesToDeleteAfterUpload, { - absolute: true, - nodir: true, - }); + const filePathsToDelete = await globFiles(updatedFilesToDeleteAfterUpload); if (debug) { filePathsToDelete.forEach(filePathToDelete => { // eslint-disable-next-line no-console diff --git a/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts b/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts index 560552ed278d..a7db6362b9fa 100644 --- a/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts +++ b/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts @@ -1,6 +1,6 @@ import { createSentrySDK } from 'sentry'; import { rm } from 'node:fs/promises'; -import { glob } from 'glob'; +import { globFiles } from '@sentry/bundler-plugins/core'; import type { ResolvedConfig } from 'vite'; import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; import { sentryOnBuildEnd } from '../../../src/vite/buildEnd/handleOnBuildEnd'; @@ -11,7 +11,7 @@ vi.mock('node:fs/promises', () => { const rm = vi.fn().mockResolvedValue(undefined); return { rm, default: { rm } }; }); -vi.mock('glob'); +vi.mock('@sentry/bundler-plugins/core', () => ({ globFiles: vi.fn() })); type TestConfig = ResolvedConfig & { sentryConfig: SentryReactRouterBuildOptions; @@ -62,7 +62,7 @@ describe('sentryOnBuildEnd', () => { vi.mocked(createSentrySDK) .mockReset() .mockReturnValue(mockSentrySdkInstance as unknown as ReturnType); - vi.mocked(glob).mockResolvedValue(['/build/file1.map', '/build/file2.map']); + vi.mocked(globFiles).mockResolvedValue(['/build/file1.map', '/build/file2.map']); vi.mocked(rm).mockResolvedValue(undefined); }); @@ -126,10 +126,7 @@ describe('sentryOnBuildEnd', () => { directory: '/build', release: '1.2.3', }); - expect(glob).toHaveBeenCalledWith(['./build/custom/**/*.map'], { - absolute: true, - nodir: true, - }); + expect(globFiles).toHaveBeenCalledWith(['./build/custom/**/*.map']); }); it('should upload source maps when enabled', async () => { @@ -196,7 +193,7 @@ describe('sentryOnBuildEnd', () => { expect(mockSentrySdkInstance.sourcemap.inject).not.toHaveBeenCalled(); expect(mockSentrySdkInstance.sourcemap.upload).not.toHaveBeenCalled(); - expect(glob).not.toHaveBeenCalled(); + expect(globFiles).not.toHaveBeenCalled(); expect(rm).not.toHaveBeenCalled(); }); @@ -219,7 +216,7 @@ describe('sentryOnBuildEnd', () => { expect(mockSentrySdkInstance.sourcemap.inject).toHaveBeenCalledWith({ directory: '/build' }); expect(mockSentrySdkInstance.sourcemap.upload).not.toHaveBeenCalled(); - expect(glob).not.toHaveBeenCalled(); + expect(globFiles).not.toHaveBeenCalled(); }); it('should delete custom files after upload when specified', async () => { @@ -239,10 +236,7 @@ describe('sentryOnBuildEnd', () => { // @ts-expect-error - mocking the React config await sentryOnBuildEnd(config); - expect(glob).toHaveBeenCalledWith('/custom/**/*.map', { - absolute: true, - nodir: true, - }); + expect(globFiles).toHaveBeenCalledWith('/custom/**/*.map'); }); it('should handle errors during release creation gracefully', async () => { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2a91780c902f..8fdf9d3f0812 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1977,9 +1977,6 @@ importers: '@sentry/server-utils': specifier: 11.10.0 version: link:../server-utils - glob: - specifier: ^14.0.3 - version: 14.0.3 sentry: specifier: ^0.44.0 version: 0.44.0 From 8322d9394741386e3d978e2b82edf4b412108033 Mon Sep 17 00:00:00 2001 From: Charly Gomez Date: Tue, 3 Nov 2026 11:04:15 +0100 Subject: [PATCH 4/6] fix(react-router): Build the default source map deletion glob with forward slashes React Router resolves `buildDirectory` with the platform separator, so on Windows the default `filesToDeleteAfterUpload` pattern contained backslashes. glob reads those as escape characters, the pattern never matched, and the uploaded source maps were kept in the build output. Co-Authored-By: Claude Fable 5.1 --- .../src/vite/buildEnd/handleOnBuildEnd.ts | 8 ++++- .../vite/buildEnd/handleOnBuildEnd.test.ts | 31 +++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts b/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts index 79d413c99861..0f83b4553ecb 100644 --- a/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts +++ b/packages/react-router/src/vite/buildEnd/handleOnBuildEnd.ts @@ -1,4 +1,5 @@ import { rm } from 'node:fs/promises'; +import * as path from 'node:path'; import type { Config } from '@react-router/dev/config'; import { createSentrySDK } from 'sentry'; import { globFiles } from '@sentry/bundler-plugins/core'; @@ -24,6 +25,11 @@ function getSentryConfig(viteConfig: unknown): SentryReactRouterBuildOptions { return (viteConfig as { sentryConfig: SentryReactRouterBuildOptions }).sentryConfig; } +/** Glob patterns need forward slashes, but React Router resolves `buildDirectory` with the platform separator. */ +function toGlobPath(directory: string): string { + return directory.split(path.sep).join('/'); +} + /** * A build end hook that handles Sentry release creation and source map uploads. * It creates a new Sentry release if configured, uploads source maps to Sentry, @@ -123,7 +129,7 @@ export const sentryOnBuildEnd: BuildEndHook = async ({ reactRouterConfig, viteCo // set a default value no option was set if (typeof updatedFilesToDeleteAfterUpload === 'undefined') { - updatedFilesToDeleteAfterUpload = [`${reactRouterConfig.buildDirectory}/**/*.map`]; + updatedFilesToDeleteAfterUpload = [`${toGlobPath(reactRouterConfig.buildDirectory)}/**/*.map`]; debug && // eslint-disable-next-line no-console console.info( diff --git a/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts b/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts index a7db6362b9fa..548fea3b7145 100644 --- a/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts +++ b/packages/react-router/test/vite/buildEnd/handleOnBuildEnd.test.ts @@ -1,5 +1,6 @@ import { createSentrySDK } from 'sentry'; import { rm } from 'node:fs/promises'; +import type * as path from 'node:path'; import { globFiles } from '@sentry/bundler-plugins/core'; import type { ResolvedConfig } from 'vite'; import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; @@ -219,6 +220,36 @@ describe('sentryOnBuildEnd', () => { expect(globFiles).not.toHaveBeenCalled(); }); + it('deletes the source maps in the build directory by default', async () => { + // @ts-expect-error - mocking the React config + await sentryOnBuildEnd(defaultConfig); + + expect(globFiles).toHaveBeenCalledWith(['/build/**/*.map']); + expect(rm).toHaveBeenCalledWith('/build/file1.map', { force: true }); + expect(rm).toHaveBeenCalledWith('/build/file2.map', { force: true }); + }); + + it('builds the default deletion pattern with forward slashes on Windows', async () => { + vi.doMock('node:path', async importOriginal => ({ + ...(await importOriginal()), + sep: '\\', + })); + const { sentryOnBuildEnd: sentryOnBuildEndWin32 } = await import('../../../src/vite/buildEnd/handleOnBuildEnd'); + const { globFiles: globFilesWin32 } = await import('@sentry/bundler-plugins/core'); + vi.mocked(globFilesWin32).mockResolvedValue([]); + + const config = { + ...defaultConfig, + reactRouterConfig: { ...defaultConfig.reactRouterConfig, buildDirectory: 'C:\\app\\build' }, + }; + + // @ts-expect-error - mocking the React config + await sentryOnBuildEndWin32(config); + + expect(globFilesWin32).toHaveBeenCalledWith(['C:/app/build/**/*.map']); + vi.doUnmock('node:path'); + }); + it('should delete custom files after upload when specified', async () => { const config = { ...defaultConfig, From a2ede9fdf163293c02eed24590506e3d2221d9bd Mon Sep 17 00:00:00 2001 From: Charly Gomez Date: Tue, 3 Nov 2026 11:04:15 +0100 Subject: [PATCH 5/6] test(bundler-plugins): Cover query and hash suffixes in the upload glob glob 14 pulls in minimatch 11, whose matcher was rewritten with changed extglob semantics. The rollup upload patterns rely on `?(\?*)?(#*)`, so exercise that suffix against the real matcher. Co-Authored-By: Claude Fable 5.1 --- packages/bundler-plugins/test/core/glob.test.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/packages/bundler-plugins/test/core/glob.test.ts b/packages/bundler-plugins/test/core/glob.test.ts index 74583dd01c4e..ffbc776fecc6 100644 --- a/packages/bundler-plugins/test/core/glob.test.ts +++ b/packages/bundler-plugins/test/core/glob.test.ts @@ -140,6 +140,15 @@ describe('globFiles', () => { expect(result).toEqual([]); }); + it.skipIf(process.platform === 'win32')('matches files with a query or hash suffix', async () => { + const files = await Promise.all([touch('a.js?v=1'), touch('a.js.map#hash'), touch('b.mjs?v=1#hash')]); + await touch('c.css?v=1'); + + const result = await globFiles(JS_AND_MAP_PATTERNS, { root: tmpDir }); + result.sort(); + expect(result).toEqual(files.sort()); + }); + it('works in nested subdirectories', async () => { const files = await Promise.all([touch('src', 'deep', 'a.js'), touch('src', 'deep', 'a.js.map')]); From 0baa2118e56f0318c4f6831670668313b6eb7446 Mon Sep 17 00:00:00 2001 From: Charly Gomez Date: Tue, 3 Nov 2026 11:04:15 +0100 Subject: [PATCH 6/6] build(browser-integration-tests): Bump glob to 14.0.3 Keeps `pnpm audit` from flagging GHSA-3g3m-2fjr-6pw4 through a package we control. Co-Authored-By: Claude Fable 5.1 --- dev-packages/browser-integration-tests/package.json | 2 +- pnpm-lock.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dev-packages/browser-integration-tests/package.json b/dev-packages/browser-integration-tests/package.json index 416639132e92..000d5840580e 100644 --- a/dev-packages/browser-integration-tests/package.json +++ b/dev-packages/browser-integration-tests/package.json @@ -77,6 +77,6 @@ "@sentry/rrweb-types": "^2.45.0", "@sentry/wasm": "11.10.0", "@types/node": "^20.19.0", - "glob": "^13.0.6" + "glob": "^14.0.3" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8fdf9d3f0812..adb34c67fe56 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -344,8 +344,8 @@ importers: specifier: ^20.19.0 version: 20.19.43 glob: - specifier: ^13.0.6 - version: 13.0.6 + specifier: ^14.0.3 + version: 14.0.3 dev-packages/bun-integration-tests: dependencies: