fix: update glob to v10.5.0 to resolve CVE-2025-64756

[ram-ui-dev]

Summary

This PR updates the glob package to version ^10.5.0 to resolve the command injection vulnerability CVE-2025-64756.

Changes included:

• Updated glob dependency in packages/react-native-builder-bob from ^8.0.3 to ^10.5.0.
• Refactored src/utils/compile.ts to use the new globSync named export from glob v10 API.
• Removed @types/glob from devDependencies as glob v10 includes built-in type definitions, and the old types caused conflicts.
• Added a resolution in the root package.json to force glob@^10.5.0 across the monorepo, ensuring no vulnerable versions remain in the lockfile.

Test plan

1. Automated Tests: Ran yarn test in packages/react-native-builder-bob. All tests passed.

   yarn workspace react-native-builder-bob test

2. Type Check: Ran yarn typecheck to verify that removing @types/glob and using built-in types works correctly.

   yarn typecheck

3. Lint Check: Ran yarn lint to ensure no linting errors.

   yarn lint

---

Note

Updates glob to ^10.5.0, refactors to use globSync, and removes @types/glob now that types are bundled.

• Dependencies
  • Bump glob in packages/react-native-builder-bob/package.json from ^8.0.3 to ^10.5.0.
  • Remove @types/glob from devDependencies (types included in glob v10).
• Build utils
  • Refactor packages/react-native-builder-bob/src/utils/compile.ts to import { globSync } from glob and replace glob.sync call.
• Lockfile
  • Update yarn.lock to reflect [email protected] and updated transitive dependencies.

^{Written by Cursor Bugbot for commit 1f1c339. This will update automatically on new commits. Configure here.}

[satya164]

Thanks for the PR.

Please remove glob from resolutions. Overriding package version for monorepo only means we are not testing with the same set of dependencies that users may get. So the dependency tree could still contain vulnerable versions of glob while the monorepo doesn't show this, or result in different behavior from what users will install.

[ram-ui-dev]

Fixed in the latest commit. Thanks!