Update versions to resolve security vulnerabilities in transitive dependencies

[sridharam]

This is required for #96 as validation checks are failing

Resolves security vulnerabilities in transitive dependencies by updating package resolutions.

Changes

Vulnerability fixes in resolutions:

• fast-xml-parser → >=5.3.6 (was >=5.3.4) — fixes DoS via entity expansion in DOCTYPE (advisory)

  • Path: @actions/artifact > @azure/storage-blob > @azure/core-xml > fast-xml-parser

• minimatch → >=10.2.1 — fixes ReDoS via repeated wildcards with non-matching literal (advisory)

  • Path: @actions/artifact > archiver > archiver-utils > glob > minimatch
  • Path: @actions/artifact > archiver > zip-stream > archiver-utils > glob > minimatch
  • Path: @actions/artifact > archiver > readdir-glob > minimatch

Dev tooling fix in resolutions:

• test-exclude → ^7.0.1 — required because the global minimatch resolution forces v10.x, which changes the default export from a callable function to an object. The test-exclude package (used by Jest/Istanbul for code coverage instrumentation) calls minimatch() as a direct function, which breaks with v10. Version 7.0.1 of test-exclude uses the destructured named import (const { minimatch } = require('minimatch')) which is compatible with v10. This is a transitive dev dependency of babel-plugin-istanbul — it is never bundled into dist/ and has zero impact on customer workflows.

License cache updates:

• Updated balanced-match and brace-expansion license metadata from other to mit — these new transitive dependencies (pulled in by minimatch 10.x) have valid MIT license text but the licensed tool could not auto-detect the SPDX identifier.

Updated files:

• package.json (resolutions)
• yarn.lock (regenerated)
• dist/ (rebuilt via yarn run package)
• .licenses/npm/balanced-match.dep.yml
• .licenses/npm/brace-expansion.dep.yml

Why minimatch required special handling

The minimatch 10.x upgrade is a breaking API change: require('minimatch') returns an object instead of a callable function. However, the production code in the dependency chain (glob, readdir-glob) uses the Minimatch class via const { Minimatch } = require('minimatch'), which still works in v10. The only breakage was in test-exclude v6 (a dev-only transitive dependency) which used the old const minimatch = require('minimatch') default import. Upgrading test-exclude to v7.0.1 resolves this since it was updated to use the named import.

The upstream archiver package is effectively unmaintained and has not updated its dependencies, which is why the resolution approach is necessary.

Impact verification: minimatch 10.x API change is safe

The minimatch 10.x default export changed from a callable function to an object. Verified that this does not affect any production code:

• Source code (src/, __tests__/): Zero references to minimatch. The action code does not use minimatch directly.
• Bundled dist files (dist/*.js): Minimatch is present as a transitive dependency inside the NCC bundles (from @actions/artifact > archiver > glob/readdir-glob). Every usage across all four bundles uses the class-based API (new Minimatch(...), const { Minimatch } = require('minimatch')), which is fully compatible with v10.x. There are zero direct minimatch() function calls in any bundled file.
• Dev tooling: The only direct function call was in test-exclude v6 (Jest coverage instrumentation), resolved by upgrading to v7.0.1 which uses the named import.

No customer-facing functionality is affected by this change.

Testing

• ✅ All tests passing

• ✅ Build, lint, and format checks passed

• ✅ License validation updated

• ✅ End-to-end validation on the branch:

  1. Scan with artifact export enabled (default json output + export_scan_result_artifact: true): passed — artifact was successfully uploaded, confirming archiver > glob/readdir-glob > Minimatch class works correctly with minimatch 10.x
  2. Scan with artifact export disabled: passed — baseline scan unaffected
  3. Setup action: passed — endorctl download, config write, and auth check all working

  TODO

• Test container scan, other sca scan options and all and update before merging