Bump minimatch and @microsoft/api-extractor

[dependabot]

Bumps minimatch and @microsoft/api-extractor. These dependencies needed to be updated together.
Updates minimatch from 10.0.3 to 10.2.3

Changelog

Sourced from minimatch's changelog.

change log

10.2

• Add braceExpandMax option

10.1

• Add magicalBraces option for escape
• Fix makeRe when partial: true is set.
• Fix makeRe when pattern ends in a final ** path part.

10.0

• Require node 20 or 22 and higher

9.0

• No default export, only named exports.

8.0

• Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions
• Bump required Node.js version

7.4

• Add escape() method
• Add unescape() method
• Add Minimatch.hasMagic() method

7.3

• Add support for posix character classes in a unicode-aware way.

7.2

• Add windowsNoMagicRoot option

7.1

• Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

• ea94840 10.2.3
• 0873fba update deps
• cecaad1 more extglob coalescing for performance
• 11d0df6 limit nested extglob recursion, flatten extglobs
• c3448c4 update assertValidPattern param type to unknown from any
• 0bf499a limit recursion for **, improve perf considerably
• 9f15c58 update deps
• f42b239 10.2.2
• fa2133b update deps
• b9d0153 ci: update action workflows
• Additional commits viewable in compare view

Updates @microsoft/api-extractor from 7.55.2 to 7.57.7

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.57.7

Mon, 09 Mar 2026 15:14:07 GMT

Patches

• Bump minimatch version from 10.2.1 to 10.2.3 to address CVE-2026-27903.

7.57.6

Wed, 25 Feb 2026 21:39:42 GMT

Patches

• Bump @microsoft/tsdoc-config to ~0.18.1 to mitigate CVE-2025-69873.

7.57.5

Wed, 25 Feb 2026 00:34:29 GMT

Version update only

7.57.4

Tue, 24 Feb 2026 01:13:27 GMT

Version update only

7.57.3

Mon, 23 Feb 2026 00:42:21 GMT

Patches

• Add missing "./extends/*.json" to the package.json "exports" field so that "@​microsoft/api-extractor/extends/tsdoc-base.json" is importable.

7.57.2

Fri, 20 Feb 2026 16:14:49 GMT

Patches

• Bump minimatch from 10.1.2 to 10.2.1

7.57.1

Fri, 20 Feb 2026 00:15:03 GMT

Patches

• Add "node" condition before "import" in the "exports" map so that Node.js uses the CJS output (which handles extensionless imports), while bundlers still use ESM via "import". Fixes microsoft/rushstack#5644.

7.57.0

Thu, 19 Feb 2026 00:04:52 GMT

Minor changes

... (truncated)

Commits

• ee40f81 Bump versions [skip ci]
• 8a51049 Update changelogs [skip ci]
• e35bece chore: bump minimatch to 10.2.3 to fix vulnerability (#5675)
• f8a668d chore: bump decoupled local dependencies (#5674)
• 3b13f32 Bump versions [skip ci]
• b8a4224 Update changelogs [skip ci]
• 1a448ee Fix issues with missing files in published @microsoft/load-themed-styles an...
• 737b20a Bump TSDoc and @typescript-eslint/* dependencies to address CVEs. (#5672)
• 1a2e3a6 chore: bump decoupled local dependencies (#5660)
• 75ba91c Bump versions [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.