fix: upgrade minimatch to patched versions to resolve ReDoS vulnerabilities

[Copilot]

Summary

Fixes Dependabot security alerts #58 and #60 for minimatch ReDoS vulnerabilities.

Vulnerability Details

Two ReDoS (Regular Expression Denial of Service) vulnerabilities were found in transitive minimatch dependencies:

1. Combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (matchOne())
2. Nested *() extglobs generating catastrophically backtracking regular expressions

Both are rated High severity and affect development dependencies only.

Root Cause

The yarn.lock contained two vulnerable minimatch versions:

• minimatch@3.1.2 (needs ≥ 3.1.4 for full patch coverage) — used by eslint, eslint-plugin-react, jest
• minimatch@9.0.5 (needs ≥ 9.0.7) — used by glob

minimatch@10.2.4 was already safe (≥ 10.2.3).

Fix

Added yarn selective resolutions to package.json:

"resolutions": {
  "minimatch": "3.1.5",
  "glob/minimatch": "9.0.9",
  "@typescript-eslint/typescript-estree/minimatch": "10.2.4"
}

This upgrades:

• minimatch@3.1.2 → 3.1.5 ✅ patched
• minimatch@9.0.5 → 9.0.9 ✅ patched
• minimatch@10.2.4 preserved as-is ✅ already patched

Verification

• All existing tests pass (yarn test)
• Code review: no issues
• Security scan (CodeQL): no new alerts