chore: bump glob to 9.3.5

[theogravity]

This updates the project to use glob@9.3.5 (not using glob@10 as that looks to be ESM-only and this project does not have ESM support).

The reason for updating glob is older versions of glob uses inflight, which has a medium-level vulun that triggers our Vanta SOC2 compliance monitoring for security issues.

This version of glob no longer works for node 14, so I bumped the engine requirements to 18.

[theogravity]

I did try async function (dir, options = {}) but tests would fail with that.

wonder if using ?? {} would be better.

[dsanders11]

This needs to be marked as a breaking change (add BREAKING CHANGE: ... in the body of the commit message) so that it would trigger a v4 release on merge.

If we're going to do a breaking change we probably want to just jump to Node v18 rather than v16 which is already EOL.

But I'm not sure if we consider this worth introducing a breaking change to address.

[dsanders11]

Tests appear to be failing on Windows.

[theogravity]

@dsanders11 Addressed the comments.

[erickzhao]

I'm not sure if this is a complete solution for the purposes of resolving security scanner warnings because we still have dependencies to glob@7.2.0, glob@^7.0.5, glob@^7.1.3 as per the yarn.lock file via various transient dependencies.

[theogravity]

I'm not sure if this is a complete solution for the purposes of resolving security scanner warnings because we still have dependencies to glob@7.2.0, glob@^7.0.5, glob@^7.1.3 as per the yarn.lock file via various transient dependencies.

The transients are only on devDeps though. At least for our scanner, it only cares about deps for node_module installs.

PS C:\Users\theo\projects\asar> npm ls glob
@electron/asar@0.0.0-development C:\Users\theo\projects\asar
+-- electron-mocha@11.0.2
| `-- mocha@9.2.2
|   `-- glob@7.2.0
+-- glob@9.3.5
+-- mocha@10.1.0
| `-- glob@7.2.0
+-- rimraf@3.0.2
| `-- glob@7.2.3
`-- standard@14.3.4
  +-- eslint@6.8.0
  | `-- file-entry-cache@5.0.1
  |   `-- flat-cache@2.0.1
  |     `-- rimraf@2.6.3
  |       `-- glob@7.2.3
  `-- standard-engine@12.1.0
    `-- deglob@4.0.1
      `-- glob@7.2.3

[ckerr]

The code changes LGTM, approving on that part.

@dsanders11 is right about the node bump / breaking change question. I don't have a strong opinion there except that we probably shouldn't depend on EOL packages

@erickzhao is right that there are still other devdep vectors do depend on old versions of glob, but fixing one is better than fixing zero 🤷‍♂️

[hallelk]

bump