Resolve vulnerable glob and minimatch transitive dependencies

pnpm-workspace.yaml

@@ -14,3 +14,5 @@ overrides:
   undici@>=7 <7.30.1: 7.30.1
   fast-uri@>=3 <3.1.9: 3.1.9
   fast-uri@>=4 <4.2.3: 4.2.3
+  glob@>=9 <14.0.2: 14.0.2
+  minimatch@<11.0.1: 11.0.1

tests/static-dependency.test.ts

@@ -0,0 +1,35 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import Fastify from "fastify";
+import staticFiles from "@fastify/static";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join, resolve, sep } from "node:path";
+
+describe("static file dependency compatibility", () => {
+  let root: string;
+  const app = Fastify();
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), "cove-static-"));
+    await mkdir(join(root, "assets"));
+    await writeFile(join(root, "assets", "sample.txt"), "static fixture");
+    await app.register(staticFiles, { root, wildcard: true });
+  });
+
+  afterAll(async () => {
+    await app.close();
+    if (!root) return;
+    if (
+      !resolve(root).startsWith(resolve(tmpdir()) + sep) ||
+      !basename(root).startsWith("cove-static-")
+    )
+      throw new Error("Refusing to remove an unexpected fixture path");
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("serves a nested asset through Fastify", async () => {
+    const response = await app.inject({ method: "GET", url: "/assets/sample.txt" });
+    expect(response.statusCode).toBe(200);
+    expect(response.body).toBe("static fixture");
+  });
+});