fix: replace fast-glob with tinyglobby to drop braces (CVE-2026-93687) @W-24615276@

package.json

@@ -12,9 +12,9 @@
     "@salesforce/core": "^9.1.0",
     "@salesforce/kit": "^4.0.1",
     "@salesforce/sf-plugins-core": "^13.0.4",
-    "fast-glob": "^3.3.3",
     "fast-xml-parser": "^5.10.1",
-    "js2xmlparser": "^4.0.2"
+    "js2xmlparser": "^4.0.2",
+    "tinyglobby": "^0.2.17"
   },
   "devDependencies": {
     "@oclif/plugin-command-snapshot": "^6.0.0",
@@ -25,6 +25,7 @@
     "@types/chai": "^4.3.17",
     "@types/mocha": "^10.0.10",
     "@types/node": "^18",
+    "@types/picomatch": "^4.0.3",
     "@types/sinon": "^10.0.20",
     "eslint": "^10.12.0",
     "eslint-config-salesforce-typescript": "^7.0.0",

src/shared/fs.ts

@@ -15,7 +15,7 @@
  */
 import path from 'node:path';
 import fs from 'node:fs';
-import fg from 'fast-glob';
+import { glob } from 'tinyglobby';
 import type { CustomObject } from '@salesforce/types/metadata';
 import { convertJsonToXml, parseXml } from './convert.js';
 import { SaveableCustomObject, SaveablePlatformEvent } from './types.js';
@@ -28,13 +28,28 @@ const getObjectXmlByPathAsJson = async (objectFilePath: string): Promise<CustomO
 /** globs don't support windows path, but the input might be */
 const ensurePosixPath = (filePath: string): string => filePath.split(path.sep).join(path.posix.sep);
 
+/**
+ * tinyglobby returns paths relative to cwd (even for absolute patterns), directories with a trailing slash,
+ * and interleaves results across patterns.
+ * Glob each pattern in order, keep absolute patterns absolute, and strip the trailing slash.
+ */
+const globPaths = async (patterns: string | string[], onlyDirectories = false): Promise<string[]> => {
+  const patternList = Array.isArray(patterns) ? patterns : [patterns];
+  const results = await Promise.all(
+    patternList.map((pattern) =>
+      glob(pattern, { onlyDirectories, expandDirectories: false, absolute: path.isAbsolute(pattern) })
+    )
+  );
+  return [...new Set(results.flat().map((p) => path.normalize(p.endsWith('/') ? p.slice(0, -1) : p)))];
+};
+
 /**
  * @param targetPaths typically your pkgDirs or project path
  * @returns directories that end in `/objects/`
  */
 export const getDirectoriesThatContainObjects = async (targetPaths: string[]): Promise<string[]> => {
   const globs = targetPaths.map((p) => `${ensurePosixPath(p)}/**/objects/`);
-  return (await fg(globs, { onlyDirectories: true })).map((dir) => path.normalize(dir));
+  return globPaths(globs, true);
 };
 
 /**
@@ -43,7 +58,7 @@ export const getDirectoriesThatContainObjects = async (targetPaths: string[]): P
  */
 export const getObjectDirectories = async (targetPaths: string[]): Promise<string[]> => {
   const globs = targetPaths.map((p) => `${ensurePosixPath(p)}/**/objects/*`);
-  return (await fg(globs, { onlyDirectories: true })).map((dir) => path.normalize(dir));
+  return globPaths(globs, true);
 };
 
 /**
@@ -52,7 +67,7 @@ export const getObjectDirectories = async (targetPaths: string[]): Promise<strin
  */
 export const getObjectXmlByFolderAsJson = async (folder: string): Promise<CustomObject> => {
   const globs = `${ensurePosixPath(folder)}/*.object-meta.xml`;
-  const [objectMetaPath] = await fg(globs);
+  const [objectMetaPath] = await globPaths(globs);
   return getObjectXmlByPathAsJson(objectMetaPath);
 };
 

yarn.lock

@@ -1711,6 +1711,11 @@
   resolved "https://registry.yarnpkg.com/@types/normalize-package-data/-/normalize-package-data-2.4.4.tgz#56e2cc26c397c038fab0e3a917a12d5c5909e901"
   integrity sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==
 
+"@types/picomatch@^4.0.3":
+  version "4.0.3"
+  resolved "https://registry.yarnpkg.com/@types/picomatch/-/picomatch-4.0.3.tgz#d92bbf24166478c5457c8bb9ba41a7f49d55e094"
+  integrity sha512-iG0T6+nYJ9FAPmx9SsUlnwcq1ZVRuCXcVEvWnntoPlrOpwtSTKNDC9uVAxTsC3PUvJ+99n4RpAcNgBbHX3JSnQ==
+
 "@types/prop-types@*":
   version "15.7.15"
   resolved "https://registry.yarnpkg.com/@types/prop-types/-/prop-types-15.7.15.tgz#e6e5a86d602beaca71ce5163fadf5f95d70931c7"