bug(opencode): minimatch version is affected by ReDoS advisories #34181

Description

packages/opencode currently pins minimatch@10.0.3, which is in the affected range for these public ReDoS advisories:

• GHSA-3ppc-4f35-3m26 / CVE-2026-26996
• GHSA-23c5-xmqv-rm74 / CVE-2026-27904

This is a direct dependency in packages/opencode/package.json. The practical concern is slow glob matching from crafted patterns. I am not claiming active exploitation in opencode.

A small fix is available: bump packages/opencode to minimatch@10.2.5, which also matches the version already used by packages/core.

I opened PR #34140 with that focused dependency update.

Plugins

None

OpenCode version

Current dev branch dependency metadata

Steps to reproduce

1. Check packages/opencode/package.json for minimatch.
2. Compare 10.0.3 against the affected ranges in GHSA-3ppc-4f35-3m26 and GHSA-23c5-xmqv-rm74.
3. Review PR chore(opencode): bump minimatch #34140 for the proposed patch to 10.2.5.

Screenshot and/or share link

Not applicable.

Operating System

Not OS-specific.

Terminal

Not terminal-specific.