chore(deps): update dependency glob to v13

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
glob	dependencies	major	12.0.0 -> 13.0.0

---

Release Notes

isaacs/node-glob (glob)

v13.0.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

📦 Packages

Package	NPM	Docker
SDK Cli	@settlemint/[email protected]
SDK The Graph	@settlemint/[email protected]
SDK Portal	@settlemint/[email protected]
SDK Hasura	@settlemint/[email protected]
SDK JS	@settlemint/[email protected]
SDK Utils	@settlemint/[email protected]
SDK Next	@settlemint/[email protected]
SDK Minio	@settlemint/[email protected]
SDK IPFS	@settlemint/[email protected]
SDK Blockscout	@settlemint/[email protected]
SDK MCP	@settlemint/[email protected]
SDK Viem	@settlemint/[email protected]
SDK EAS	@settlemint/[email protected]

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	glob@​13.0.0

View full report

[sentry]

Bug: glob v13 fails to match paths on Windows due to path.join() generating backslashes, breaking monorepo package detection.
_{Severity: HIGH | Confidence: High}

🔍 Detailed Analysis

On Windows, path.join() generates backslashes in paths passed to glob. With glob v13.0.0, backslashes are treated as escape characters instead of path separators. This causes the glob pattern join(monoRepoRoot, workspace, "package.json") in sdk/utils/src/filesystem/mono-repo.ts to fail matching any files. Consequently, allPaths becomes an empty array, leading to incorrect monorepo package detection and silent functional failure on Windows systems.

💡 Suggested Fix

Convert backslashes to forward slashes using .replace(/\\/g, '/') before passing paths to glob, or use the windowsPathsNoEscape: true option for glob on Windows.

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: sdk/utils/package.json#L75

Potential issue: On Windows, `path.join()` generates backslashes in paths passed to
`glob`. With `glob` v13.0.0, backslashes are treated as escape characters instead of
path separators. This causes the glob pattern `join(monoRepoRoot, workspace,
"package.json")` in `sdk/utils/src/filesystem/mono-repo.ts` to fail matching any files.
Consequently, `allPaths` becomes an empty array, leading to incorrect monorepo package
detection and silent functional failure on Windows systems.

_{Did we get this right? 👍 / 👎 to inform future reviews.
Reference_id: 2826639}

[cubic-dev-ai]

No issues found across 2 files