[jontg]

What does this PR do?

Replaces globby@11 with tinyglobby in zipDir (src/utils/packageUtils.ts) and PackageProfileApi.findAllProfiles (src/package/packageProfileApi.ts).

globby → fast-glob → micromatch → braces@3.0.3 is flagged by an open CVE, CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm. The CVE is disputed upstream (micromatch/braces#70) and no patched release exists, so we can't wait for a fix. Dropping the dependency clears it for @salesforce/cli. tinyglobby uses fdir + picomatch (no braces) and is already in the sf CLI dependency tree through @oclif/plugin-plugins.

Notes on keeping behavior the same:

• zipDir: glob('**/*', { cwd: dir, expandDirectories: false }) returns the same cwd-relative file list. Directories, empty directories and dotfiles are handled the same way.
• findAllProfiles:
  • tinyglobby matches ignore against paths relative to cwd. With the default cwd, an absolute package dir outside process.cwd() (or a symlinked path such as /tmp → /private/tmp on macOS) produces ../ paths, and **/<excluded>/** stops matching. Using the filesystem root as cwd with absolute: true keeps globby's behavior of matching ignore against the full path.
  • Each package directory is globbed separately so results stay in package directory order, which feeds the Profile members in the generated manifest. The existing test should include profiles from all package directories when scopeProfiles is false covers this.
• @types/picomatch is added as a devDependency because fdir's typings import picomatch (same approach as oclif/core).

Testing

• yarn test (compile, lint, unit tests, link-check) passes: 288 passing.
• Ran the old globby calls and the compiled new functions side by side on a fixture project:
  • zipDir: same file set (including nested files, an empty dir, a dotfile, a dotdir and a symlink).
  • findAllProfiles: covered several package dir layouts (including nested package dirs), /tmp and /private/tmp project paths, several process.cwd() values and five excludedDirectories inputs. Results are identical per package directory, in the same package directory order. Order between sibling subfolders inside one package directory can differ, since both libraries return those in filesystem walk order.
• After this change, yarn why braces shows braces only via dev dependencies (@salesforce/dev-scripts → mocha/wireit).

What issues does this PR fix or reference?

• CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm
• Part of removing braces from @salesforce/cli runtime deps, alongside fix: replace fast-glob with tinyglobby to drop braces (CVE-2026-93687) @W-24615276@ salesforcecli/plugin-sobject#1069. A follow-up PR will go to forcedotcom/salesforcedx-apex (@salesforce/apex-node).
• @W-24615276@

[k80bowman]

Looks good! I ran CI tests on a separate branch and they all passed.