chore(deps-dev): bump glob from 13.0.3 to 13.0.6

[dependabot]

Bumps glob from 13.0.3 to 13.0.6.

Commits

• e80cb38 13.0.6
• 9cdbbff revert tsgo, not ready for test coverage correctness yet
• 89c99ba use tsgo compiler
• b7275d5 update deps, expand engines to include node 18
• 942e360 update workflows, pull taprc out of package.json
• 4a0d53c update tap for mockImport bugfix
• ef94ad2 update tap
• 180c2d4 update docs
• 37993c8 remove stray console.error in test
• 03ae4c2 13.0.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
PRE_COMMIT	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

TRIVY

Report Summary

┌───────────────────────────────────┬──────┬─────────────────┬───────────────────┬─────────┐
│              Target               │ Type │ Vulnerabilities │ Misconfigurations │ Secrets │
├───────────────────────────────────┼──────┼─────────────────┼───────────────────┼─────────┤
│ htmlhint-server/package-lock.json │ npm  │        0        │         -         │    -    │
├───────────────────────────────────┼──────┼─────────────────┼───────────────────┼─────────┤
│ htmlhint/package-lock.json        │ npm  │        3        │         -         │    -    │
├───────────────────────────────────┼──────┼─────────────────┼───────────────────┼─────────┤
│ package-lock.json                 │ npm  │        0        │         -         │    -    │
└───────────────────────────────────┴──────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


htmlhint/package-lock.json (npm)
================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 0)

┌───────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────┐
│  Library  │ Vulnerability  │ Severity │ Status │ Installed Version │                      Fixed Version                      │                          Title                           │
├───────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────┤
│ minimatch │ CVE-2026-26996 │ HIGH     │ fixed  │ 5.1.6             │ 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 │ minimatch: minimatch: Denial of Service via specially    │
│           │                │          │        │                   │                                                         │ crafted glob patterns                                    │
│           │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-26996               │
│           ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────┤
│           │ CVE-2026-27903 │          │        │                   │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 │ minimatch: minimatch: Denial of Service due to unbounded │
│           │                │          │        │                   │                                                         │ recursive backtracking via crafted...                    │
│           │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27903               │
│           ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────┤
│           │ CVE-2026-27904 │          │        │                   │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 │ minimatch: Minimatch: Denial of Service via catastrophic │
│           │                │          │        │                   │                                                         │ backtracking in glob expressions                         │
│           │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27904               │
└───────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────┘