chore(deps): bump globby from 13.2.2 to 16.2.4

[dependabot]

Bumps globby from 13.2.2 to 16.2.4.

Release notes

Sourced from globby's releases.

v16.2.4

• Fix ignore option disabling the gitignore option 19e1fce

---

sindresorhus/globby@v16.2.3...v16.2.4

v16.2.3

• Fix backslash-escaped .gitignore rules 5775ffb

---

sindresorhus/globby@v16.2.2...v16.2.3

v16.2.2

• Fix: Do not enumerate ignored directories with gitignore option 8bf8f54

---

sindresorhus/globby@v16.2.1...v16.2.2

v16.2.1

• Fix gitignore ignoring an entire checkout under an anchored ancestor path (#277) e7bd988

---

sindresorhus/globby@v16.2.0...v16.2.1

v16.2.0

• Add globalGitignore option 51555b2

---

sindresorhus/globby@v16.1.1...v16.2.0

v16.1.1

• Fix negation patterns with absolute filesystem paths 72e9916

---

sindresorhus/globby@v16.1.0...v16.1.1

v16.1.0

• Add expandNegationOnlyPatterns option eb78791
• Fix: Normalize leading-slash negation patterns before task generation 59e269f

---

sindresorhus/globby@v16.0.0...v16.1.0

... (truncated)

Commits

• 46cf13f 16.2.4
• 19e1fce Fix ignore option disabling the gitignore option
• 4f95a14 16.2.3
• 5775ffb Fix backslash-escaped .gitignore rules
• 6807768 Meta tweaks
• 14f4f47 16.2.2
• 8bf8f54 Fix: Do not enumerate ignored directories with gitignore option
• 47e7f65 16.2.1
• e7bd988 Fix gitignore ignoring an entire checkout under an anchored ancestor path (...
• 60e8167 16.2.0
• Additional commits viewable in compare view

[Copilot]

🟢 Approval recommended

The change is a straightforward dependency bump with consistent lockfile updates and no conflicting project constraints found during review.

Pull request overview

This PR updates the npm dependency globby to a newer major version, refreshing the repository’s globbing implementation and its transitive dependency tree in package-lock.json.

Changes:

• Bump globby from the ^13.x range to ^16.2.4 in package.json.
• Regenerate package-lock.json to reflect globby@16.2.4 and updated transitive dependencies (e.g., ignore, slash, plus new additions like unicorn-magic).

File summaries

File	Description
package.json	Updates the declared globby dependency version range to ^16.2.4.
package-lock.json	Locks globby@16.2.4 and updates/removes transitive dependencies accordingly.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Changyong Gong (chagong)]

Dependency necessity, major-version migration notes, Node 20 compatibility, packaging, and current-head CI verified.

[Changyong Gong (chagong)]

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-dependency
Pull request: microsoft/vscode-java-dependency#1089 — chore(deps): bump globby from 13.2.2 to 16.2.4
Update: globby 13.2.2 → 16.2.4 — major, not security-related.

Safety assessment: Bot-only provenance; compatibility-remediation gate passed without source changes. globby remains a necessary direct runtime dependency. Crossed-major changes require Node 20 and alter only unused gitignore: true behavior; the extension and CI use Node 20 or newer. Residual risk is low.

Final state: Head 65076be2838383575cfe058f12a12ff31ff46e48; merged as 63ea765eb6430f25e544249d9151af328741fddc; post-merge state UNKNOWN; review APPROVED; CI 33/33 successful with no failed or non-terminal checks.

Actions taken: Confirmed branch freshness (behind_by: 0); validated clean install, dependency tree, lint, compilation, production webpack bundle, and VSIX packaging. The local integration runner encountered an unrelated Java delegate setup failure, while all current-head Linux, Windows, macOS, and E2E jobs passed. Requested Copilot review, which recommended approval with no comments; approved and squash-merged. No rebase, recreation, CI rerun, remediation, commit, or push was needed.

Reason: None.
Next action: None.
Workflow run: https://github.com/chagong/JavaForge/actions/runs/34198101022