[zxch3n]

Risk: 🟡 medium | Confidence: medium — backports the upstream glob cancellation fix to the existing build-tool dependency; both module formats and cancellation behavior have deterministic coverage.

Problem / pressure

glob@13.0.1 may continue reading directories after an AbortSignal rejects a walk (GHSA-3g3m-2fjr-6pw4). It is used by rimraf 6 and the React docgen Vite plugin. For callers using cancellation as a traversal budget, continued work defeats that budget.

Summary

• Backport the exact behavior of upstream commit 4682e8c to both published 13.0.1 module formats: return after all four abort callbacks and retain the upstream resume handling.
• Apply the patch only to glob@13.0.1; keep the existing parent APIs and versions. The lockfile changes only the patch registration and its existing dependency edges.
• Test the public traversal cancellation boundary with a controlled first-read callback, both module implementations, and normal glob/rimraf behavior.

Validation

• Node 26.13.0, pnpm 10.20.0: original package fails 11 of 12 regression cases; patched package passes all 12. A frozen install with the narrowed lock passes.
• Node 22.23.4, pnpm 10.20.0: pnpm check passed; pnpm format and pnpm docs check passed.
• On Node 26, the full check failed one unrelated Git identity test. The same test failed with the same output on the unmodified base, same Node/pnpm and frozen base lock. No test was disabled.

Limits

This fixes the public workspace resolution only. Embedded private installs own their lock and patchedDependencies and need explicit adoption. The separate minimatch advisory is not addressed here. No packaging or deployment was performed.