fix(deps): clear audit advisories by dropping rimraf/minimatch and bumping fast-xml-parser

[rishigupta1599]

Problem

yarn audit --groups dependencies on the published production closure reported 5 advisories (4 high, 1 moderate). All reached us transitively:

Advisory	Path
brace-expansion (ReDoS)	minimatch ← glob ← rimraf@3 (@percy/core)
brace-expansion (ReDoS)	minimatch@9 (@percy/cli-doctor)
inflight (memory leak)	glob ← rimraf@3
fast-xml-parser	direct dependency of @percy/core

Why not the override the ticket recommends

PER-10247 recommends pinning brace-expansion@1 → 1.1.12 / @2 → 2.0.2 via resolutions. That does not clear the audit — only 5.0.8 satisfies the advisory, and 5.0.8 requires Node 20+. Requiring a newer Node is exactly what broke the reporting customer, so re-pinning trades one break for another. This PR removes the dependency chains instead.

Changes

• @percy/core: drop rimraf@3. Browser#close cleans the temp profile with fs.promises.rm({ recursive: true, force: true, maxRetries: 3, retryDelay: 100 }). The retry options preserve rimraf's busy-retry behaviour — on Windows the profile dir stays locked briefly after the browser exits, and a plain rm would throw EBUSY.
• scripts/test.js: same swap for the coverage-dir cleanup (the only other rimraf consumer).
• @percy/cli-doctor: drop minimatch@9. The PAC check only needed shExpMatch semantics (* and ? — no **, braces, or character classes), so it is a small self-contained matcher now. 6 new specs cover the semantics, including the cases where shExpMatch and minimatch differ.
• @percy/core: fast-xml-parser ^4.4.1 → ^4.5.7.

On fast-xml-parser: why 4.5.7 and not 5.x

My first push bumped this to ^5.7.0 and broke yarn install on every CI job, all of which pin Node 14:

error xml-naming@0.3.0: The engine "node" is incompatible with this module.
Expected version ">=16.0.0". Got "14.21.3"

^5.7.0 floats to 5.10.1, which depends on xml-naming (engines >=16). Pinning fxp alone does not help — 5.7.x depends on fast-xml-builder ^1.1.7, and fast-xml-builder@1.2.0+ pulls xml-naming in as well. Holding Node 14 on 5.x would require a resolutions pin on a dependency-of-a-dependency — the same class of fragile pin this PR set out to avoid.

So this takes the top of the 4.x line (4.5.7, npm legacy tag), which clears every fast-xml-parser advisory that has a 4.x fix: GHSA-m7jm (CRITICAL, patched 4.5.4), GHSA-8gc5 (HIGH, 4.5.5), GHSA-jp2q (MODERATE, 4.5.5), GHSA-fj3w (LOW, 4.5.4).

One advisory remains and is deliberately accepted: GHSA-gh4j-gqv2-49f6 (MODERATE, vulnerable range < 5.7.0) — XMLBuilder comment/CDATA injection via unescaped delimiters. It is not reachable from our code: maestro-hierarchy.js is the only consumer, it imports XMLParser only (never XMLBuilder), and parses with processEntities: false.

So the honest score is 5 advisories → 1, not zero. Reaching literal zero requires either Node ≥16 or a transitive-dep pin. Happy to go either way if reviewers prefer — flagging it rather than burying it.

Verification

• Production closure computed from yarn.lock (127 external packages, prod deps only, seeded from each workspace package's dependencies): rimraf, minimatch, glob, inflight, brace-expansion all absent; no Node-16-only package present; fast-xml-parser resolves to 4.5.7 with strnum@1.1.2 as its only dependency (strnum has no advisories).
• @percy/cli-doctor: 514/514 specs pass (508 existing + 6 new). Independent confirmation that minimatch@9 is gone: master's pac.js can no longer even load in this tree.
• Repo-wide lint clean.
• fs.promises.rm behaviour checked directly: recursive delete, missing-path tolerance under force, and that maxRetries/retryDelay are accepted on our Node floor.
• @percy/core suite: gating on CI. Local runs here are contaminated by leftover real temp dirs (percy-self-hosted-real-root, percy-bs-tmp-real-root) from an earlier crashed run: core mocks fs with memfs, so the fs.rmSync(recursive, force) cleanup in api.test.js cannot clear real leftovers, and the whole maestro self-hosted group then 404s. Those paths do not exist on a fresh CI machine, where force: true no-ops. Please gate on the CI result rather than my local run.

Ref: PER-10247

🤖 Generated with Claude Code