glob@13.0.6 default bundle retains pre-fix minimatch and brace-expansion copies

glob@13.0.6 has different dependency behavior between its default and raw
entries:

require('glob')     -> dist/commonjs/index.min.js -> bundled dependencies
require('glob/raw') -> dist/commonjs/index.js     -> dependencies from node_modules

The default bundle's source map contains:

• minimatch source byte-identical to minimatch@10.2.2
• brace-expansion source matching the affected 5.0.2/5.0.3 implementation

A fresh install on 2026-09-18 resolved patched external versions
minimatch@10.2.6 and brace-expansion@5.0.12. Those versions are used by
glob/raw, but they do not replace the copies frozen inside the default bundle.

This leaves the default entry behind two already-public upstream fixes:

• minimatch nested-extglob backtracking, fixed in 10.2.3:
  https://github.com/advisories/GHSA-23c5-xmqv-rm74
• brace-expansion numeric-range allocation before max, fixed in 5.0.6:
  https://github.com/advisories/GHSA-jxxr-4gwj-5jf2

For example, the brace-expansion difference can be observed safely without
walking the filesystem. In an empty directory:

npm install glob@13.0.6

Save as check.cjs:

'use strict';

const entry = process.argv[2];
const { hasMagic } = require(entry);

global.gc?.();
const before = process.memoryUsage().heapUsed;
const started = process.hrtime.bigint();

hasMagic('{1..1000000}', { braceExpandMax: 10 });

console.log({
  entry,
  elapsedMs: Number(process.hrtime.bigint() - started) / 1e6,
  heapDeltaMiB: (process.memoryUsage().heapUsed - before) / 1024 / 1024,
});

Run each entry separately:

node --expose-gc check.cjs glob/raw
node --expose-gc check.cjs glob

Observed on my machine:

glob/raw: about 1.4 ms, 0.2 MiB additional heap
glob:     about 46 ms, 45 MiB additional heap

The same entry difference applies to the minimatch fix. With the nested extglob
from its public advisory, glob/raw completed in about 32 ms while the default
bundle remained CPU-bound until a bounded five-second timeout. The default
entry did not load external minimatch during that run.

Could the default CommonJS and ESM bundles be regenerated with
minimatch@10.2.3 or later and brace-expansion@5.0.6 or later, then published
in a new glob release? Updating a consumer lockfile or override does not alter
the dependency code already compiled into the published index.min.js files.

Start by comparing the package entry points and generated files named in the report: dist/commonjs/index.min.js, dist/commonjs/index.js, and the corresponding CommonJS and ESM bundles. Run the provided check.cjs comparison against glob and glob/raw, then verify that regenerated bundles no longer retain the older minimatch and brace-expansion implementations and that the corrected artifacts are ready for a new release.