[jlevy]

Summary

This is the first half of the v0.3.0 release. The second half, #58, adds requires:. The release was renumbered from v0.2.2 to v0.3.0 at the maintainer's request, since it bundles a runtime dependency swap, broad dependency upgrades, and a new feature. v0.2.2 was never tagged.

This PR clears every open audit finding (one runtime, six dev-only), fixes #55, and applies the dependency bumps that are past the cool-off. No cool-off exception is taken: every resolved version predates the 14-day cutoff (2026-09-20T21:55Z).

• An unset variable in path: puts the working directory on PATH #55: an unset $VAR in path: went through resolve(testDir, ''), which put the test file's directory on PATH. Such entries are now dropped. A run with no inherited PATH no longer gets an empty element.
• Replace fast-glob with tinyglobby to drop braces (GHSA-vfj7-8cjw-p6xm) #56: fast-glob → micromatch → braces (GHSA-vfj7-8cjw-p6xm, unpatched) is replaced with tinyglobby, in src/lib/discovery.ts.
• Dev advisories and tooling:
  • vitest and coverage-v8 4.1.11, brace-expansion 5.0.12, @humanfs/node 0.16.8;
  • typescript-eslint 8.70.0, prettier 3.9.8, publint 0.3.24, lefthook 2.1.14;
  • override cleanup.
• Version and CHANGELOG: 0.3.0.

tinyglobby needed a discovery layer to keep fast-glob semantics

Using tinyglobby 0.2.17 directly, as #56 proposes, silently drops tests in several ways. findTestFiles handles each one:

1. A pattern rooted above cwd drops files inside cwd. For example, ../../**/*.tryscript.md from packages/tryscript returned 1 file instead of 33. tinyglobby matches candidates relative to its own cwd. Fix: each positive pattern is globbed separately, from the deepest directory containing cwd and that pattern's static base.
2. An unreadable directory is skipped silently. fdir suppresses readdir errors; fast-glob threw EACCES. Fix: errors are recorded through tinyglobby's fs adapter, and discovery fails naming the directory (exit 2). Only ENOENT is ignored.
3. Negations. These are matched to fast-glob's isAffectDepthOfReadingPattern rule:
   • A negation whose last segment is **, a literal name, or a brace list of literal names goes into tinyglobby's ignore list, so the excluded directory is never read.
   • Other negations (!dir/*, or one rooted above a pattern's frame) subtract the files they match.
   • A negation that cannot overlap any positive pattern is not crawled.
4. Windows UNC roots are preserved when joining bases (posix.join collapsed //server/share).

Parity: against fast-glob 3.3.3, every pattern and negation case under cwd matches. That covers this repo's trees plus the reviewer's adversarial sets: negparity, negadv2, negprune, intermediate, symlinks, ./, a/../b, and a cwd inside dist. Intended differences, all documented in the CHANGELOG and reference:

• Patterns that climb above cwd (../**) now apply the node_modules/dist ignores and negations, which fast-glob skipped for them.
• An absolute pattern into a project located under a dist directory now finds its files; fast-glob found nothing.
• Exclusions do not match inside dot directories unless they name them. This is the same dot rule inclusions use.

Senior review

A delegated senior-engineer review ran three rounds over this PR and #58.

• Fixed here: discovery read errors, ignore frame, intermediate-directory listing, UNC roots, negation pruning, !dir, brace-list negations, and crawls of non-overlapping negations.
• Remaining: none open. Two Low items became follow-up beads: broadening Windows CI, and a single definition for requires validation.

Supply-chain review

• New runtime dependencies: tinyglobby 0.2.17 (trusted publishing and provenance), fdir 6.5.0, picomatch 4.0.7. None runs lifecycle scripts, and each keeps its previous publisher. The picomatch 4.0.5 → 4.0.7 diff touches only the parser.
• Held back:
  • eslint ≥ 10.10, which pulls in file-entry-cache 11 → flat-cache → cacheable → keyv (the keyv worm family).
  • tsx 4.23.15, which repackages its dist two hours after 4.23.14.
• Avoided: pnpm update --depth Infinity would also have dragged in rollup 4.63.4 and postcss.

Validation plan

• pnpm verify on the head: 281 unit tests, v0.1.7 compatibility replay, pnpm audit clean.
• test:coverage: 127 golden blocks.
• Discovery tests (27, including injected read errors) and the An unset variable in path: puts the working directory on PATH #55 regressions fail on the defective code and pass on the fix.
• Consumer install of the packed tarball: npm audit reports 0 vulnerabilities, and fast-glob, micromatch and braces are gone.
• Real EACCES verified as an unprivileged user.
• CI green on the head (Windows coverage comes from Release v0.3.0 (part 2): requires: (#54), Windows CI, tbd v0.10.0 #58's job).
• After Release v0.3.0 (part 2): requires: (#54), Windows CI, tbd v0.10.0 #58 merges: tag v0.3.0 on main and verify npm and the GitHub release.

Closes #55
Closes #56

🤖 Generated with Claude Code

https://claude.ai/code/session_01W5x8Ticwm5ZY4j2DLhCbXD

[deepsource-io]

DeepSource Code Review

We reviewed changes in 1ffbe8f...5527761 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Oct 4, 2026 11:17p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	97.46%	5333 / 5472
🔵	Statements	97.46%	5333 / 5472
🔵	Functions	63.78%	162 / 254
🔵	Branches	55.1%	826 / 1499

File Coverage

No changed files found.

Generated in workflow #189 for commit 5527761 by the Vitest Coverage Report Action