[gregpriday]

Summary

Every open PR failed CI on the Security Audit job (npm audit --omit=dev --audit-level=high). Two packages were behind it: simple-git (critical, tracked in daintreehq/daintree#13556, which needs CopyTree off the default export v4 removes) and braces (high, no patched release at all), which came in through micromatch and fast-glob. This clears both. It also lands everything the open Dependabot PRs proposed, so those can close as superseded.

Swapping fast-glob turned up a pre-existing hole: with followSymlinks: false, --always 'keys/*.txt' still read through keys when it was a directory link, including one pointing outside the repository. That's fixed, with a test.

Changes

• simple-git ^4.0.2: GitUtils imports the named simpleGit export. None of its calls use abbreviated options or pass Git environment variables, so v4's new guards don't apply. Checked --modified and --changed develop against this repository.
• micromatch → picomatch: micromatch.matcher() was picomatch() under another name. compileGlobs() in pathUtils.js always passes an options object, because picomatch ≥3 only consults the platform when given one.
• fast-glob → tinyglobby for force-includes and ignore check's on-disk listing. Gaps in tinyglobby are closed in collectForcedEntries:
  • Brace ranges are spelled out as comma lists, since picomatch doesn't expand {01..03}. Ranges over 1000 values are still refused, as braces refused them.
  • A match is dropped unless its real path is the path it was matched at, when links aren't followed.
  • An unreadable directory is reported once as unreadable instead of failing the run with EACCES.
• Dependencies: everything updated to the latest version within range, plus the four pinned actions (SHAs match Dependabot's).
• Not taken: Babel 8, whose engines floor (^22.18) is above ours (22.12). Jest 30.5, whose module system keeps a file:// import's ?t= query as part of the path, so the legacy user-config test fails under Jest while the code works in Node. .github/dependabot.yml records the Jest hold and groups @jest/* and babel-jest with jest.
• knip 6.42 flagged two pre-existing test issues: jest-diff was used but undeclared, and a jest.mock targeted a module that doesn't exist.
• docs/technical/behavior-ledger.md records each behaviour change, plus one known gap. With followSymlinks: true, fdir treats a link inside a followed link that points further into the same target as a cycle.

Testing

• npm run verify:release: lint, format, CLI docs, links, typecheck, knip, knip production, coverage (133 suites, 2414 tests), package check.
• npm audit --omit=dev --audit-level=high: 0 vulnerabilities. The 19 dev-only moderates are inside Jest's istanbul chain with no upstream fix; that CI step is continue-on-error.
• New tests/real/pipeline/stages/FileDiscoveryStage.forceInclude.test.js: ranges, a range after a literal brace group, escaped braces, the range limit, unreadable directories, and directory links followed and not followed. The link test fails with the new check removed.
• Ranges, links and unreadable directories were compared against fast-glob 3.3.3 directly. Codex reviewed it twice, and its findings are fixed or recorded in the ledger.

Supersedes #149, #151, #152, #153, #154, #155.