chore: dependabot

[grothem]

closes AAVE-4022

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 69847b5.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

package-lock.json

Name	Version	Vulnerability	Severity
minimatch	5.1.7	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	high
		minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	high

Only included vulnerabilities with severity moderate or higher.

OpenSSF Scorecard

Package	Version	Score	Details
npm/minimatch	5.1.7	🟢 6.2	Details Check Score Reason Maintained 🟢 10 23 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 1/28 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[linear]

AAVE-4022 [Vanta] Remediate "High vulnerabilities identified in packages are addressed (GitHub Repo)" for npm-minimatch >= 5.0.0, < 5.1.7/CVE-2026-26996 (protocol-subgraphs)