chore(deps): bump @types/node, eslint and knip

osv-scanner.toml

@@ -1,8 +1,16 @@
 # OSV-Scanner allowlist. Each entry must document why the advisory is not
 # exploitable in this codebase. Keep this list minimal and revisit on review.
-#
-# Empty on purpose: every advisory this tree carries currently has a reachable
-# fix. The brace-expansion entry that lived here is gone because upstream
-# backported the DoS fix to the 1.x line (1.1.17, then 1.1.18 for the follow-up
-# bypass), so the "no fixed release on 1.x" that justified it is no longer true
-# and minimatch@3's own `^1.1.7` range takes the fix with no override.
+
+# minimatch: GHSA-g3hv-75wg-m249 (DoS through globparts amplification) is fixed
+# only in 11.0.1; no 10.x release carries it. Every copy in this lock is lint
+# tooling (eslint and its config-array, typescript-eslint's typescript-estree,
+# eslint-plugin-import-x) matching patterns we write ourselves, and none of it
+# ships in the published package. Their ^10 ranges do not admit 11. Remove the
+# entry when its parents' latest releases admit 11.
+[[PackageOverrides]]
+name = "minimatch"
+version = "10.2.6"
+ecosystem = "npm"
+effectiveUntil = 2027-01-31
+vulnerability.ignore = true
+reason = "No fixed 10.x; pulled at ^10 by eslint, @eslint/config-array, typescript-estree and eslint-plugin-import-x; lint tooling only, not in the published package."

package.json

@@ -52,13 +52,13 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "@vitest/coverage-v8": "^5.0.5",
     "dotenv": "^18.0.9",
-    "eslint": "^10.13.0",
+    "eslint": "^10.14.0",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "knip": "^6.43.0",
+    "knip": "^6.44.1",
     "lefthook": "^2.2.2",
     "tsup": "^9.0.0",
     "typescript": "^6.0.3",