fix: Remediate CVE-2025-64756 by upgrading glob to 10.5.0

[Copilot]

CVE-2025-64756 is a command injection vulnerability in glob CLI's -c/--cmd option affecting versions 10.2.0 to 10.4.5. Transitive dependency was pinned at 10.4.5 via @semantic-release/npm and pacote.

Changes

• Added [email protected] to resolutions (yarn) and overrides (npm) in package.json
• Updated yarn.lock to resolve all glob dependencies to 10.5.0

"overrides": {
  "glob": "10.5.0"
},
"resolutions": {
  "glob": "10.5.0"
}

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Vanta] Remediate "High vulnerabilities identified in packages are addressed (GitHub Repo)" for npm-glob >= 10.2.0, < 10.5.0/CVE-2025-64756 (taskforce-connector)</issue_title>
<issue_description>What's wrong?
You have open high severity vulnerabilities.

Github Vulnerability

• npm-glob >= 10.2.0, < 10.5.0/CVE-2025-64756 (taskforce-connector)

How to fix?

1. Visit the Vulnerabilities page to learn more about the unresolved vulnerabilities.
2. Remediate or deactivate monitoring for each unresolved vulnerability.
3. Optional] If the vulnerability was resolved outside of the SLA you’ve defined, explain the reason to your auditor on the [SLA violations page.

This issue was automatically created from Vanta. View test in Vanta</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Vanta] Remediate "High vulnerabilities identified in packages are addressed (GitHub Repo)" for npm-glob >= 10.2.0, < 10.5.0/CVE-2025-64756 (taskforce-connector) #123

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🎉 This PR is included in version 1.36.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀