build(deps): Bump @sentry/node and force minimatch to fix GHSA-3ppc-4f35-3m26

[oioki]

Fix minimatch vulnerability (GHSA-3ppc-4f35-3m26, affects 9.0.0–9.0.5, fixed in 9.0.6) using the same "bump dependants" approach taken for the qs prototype pollution fix.

Two instances of vulnerable minimatch were present:

Production dep — bump the dependant:
@sentry/[email protected] required minimatch@^9.0.0, which resolved to the vulnerable 9.0.5. @sentry/[email protected] drops minimatch entirely, removing the production-side exposure. @sentry/profiling-node is bumped in lockstep.

Dev dep — forced resolution:
@typescript-eslint/[email protected] (via eslint-config-sentry-app) hard-pins [email protected] (exact, not a range). The "bump dependants" path here would require upgrading eslint-config-sentry-app from 1.x to 2.x (a major version change involving @typescript-eslint 8.x). Instead, a broad "minimatch": "9.0.6" resolution is used — the same pattern as the existing json5 fix. Yarn v1 selective resolutions ("pkg/minimatch": "9.0.6") cannot override exact-version pins in transitive deps, so the broad approach is necessary.

minimatch 9.x exposes the same CJS API as 3.x, so all consumers (eslint, jest, glob, @fastify/otel) remain compatible. All tests pass.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Broad resolution forces minimatch major version downgrade for @fastify/otel

Medium Severity

The broad "minimatch": "9.0.9" resolution in package.json forces @fastify/[email protected]'s minimatch@^10.0.3 dependency to resolve to 9.0.9, a major version downgrade outside the requested semver range. @fastify/otel is a new production dependency introduced by @sentry/[email protected]. While the core matching API is the same across versions, minimatch 10.x has module format differences (ESM-related brace-expansion changes), and future @fastify/otel updates could rely on 10.x-specific behavior. A scoped resolution (e.g., targeting only the known-vulnerable paths) would be safer than the broad override.

Additional Locations (1)

• package.json#L51-L52

 

[oioki]

The issue is real in theory but not exploitable here. Here's the evidence:

1. @fastify/otel uses require('minimatch').minimatch (named export) — this works correctly in 9.0.9:
   mm.minimatch: function ✓
2. URL patterns work identically between 9.0.9 and 10.x — /api/*, /{a,b}, /api/** all match correctly with 9.0.9.
3. @fastify/otel is never instantiated in chartcuterie — the app uses Express, not Fastify. src/instrument.ts only initialises @sentry/node + profiling. @fastify/otel is dead code in this dep tree; its
   ignorePaths glob path is never reached at runtime.
4. The only real difference between 9.x and 10.x is brace-expansion (^2.0.2 → ^4.0.0) and Node.js engine floor. Neither affects URL glob semantics for the patterns @fastify/otel uses.