deps: Bump globby from 14.1.0 to 16.2.4

[dependabot]

Bumps globby from 14.1.0 to 16.2.4.

Release notes

Sourced from globby's releases.

v16.2.4

• Fix ignore option disabling the gitignore option 19e1fce

---

sindresorhus/globby@v16.2.3...v16.2.4

v16.2.3

• Fix backslash-escaped .gitignore rules 5775ffb

---

sindresorhus/globby@v16.2.2...v16.2.3

v16.2.2

• Fix: Do not enumerate ignored directories with gitignore option 8bf8f54

---

sindresorhus/globby@v16.2.1...v16.2.2

v16.2.1

• Fix gitignore ignoring an entire checkout under an anchored ancestor path (#277) e7bd988

---

sindresorhus/globby@v16.2.0...v16.2.1

v16.2.0

• Add globalGitignore option 51555b2

---

sindresorhus/globby@v16.1.1...v16.2.0

v16.1.1

• Fix negation patterns with absolute filesystem paths 72e9916

---

sindresorhus/globby@v16.1.0...v16.1.1

v16.1.0

• Add expandNegationOnlyPatterns option eb78791
• Fix: Normalize leading-slash negation patterns before task generation 59e269f

---

sindresorhus/globby@v16.0.0...v16.1.0

... (truncated)

Commits

• 46cf13f 16.2.4
• 19e1fce Fix ignore option disabling the gitignore option
• 4f95a14 16.2.3
• 5775ffb Fix backslash-escaped .gitignore rules
• 6807768 Meta tweaks
• 14f4f47 16.2.2
• 8bf8f54 Fix: Do not enumerate ignored directories with gitignore option
• 47e7f65 16.2.1
• e7bd988 Fix gitignore ignoring an entire checkout under an anchored ancestor path (...
• 60e8167 16.2.0
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[d3xter666]

What broke and why

@ui5/fs implements builder-excludes by converting each exclude string to a negated glob pattern (!pattern) and appending it to the incoming pattern array. When the positive pattern normalises away — e.g., querying /resources/**/.library against a reader rooted at /test-resources/ — only the negated exclude remains. In globby ≤15, a negation-only pattern list returned []. In globby 16.1.0, the new expandNegationOnlyPatterns option (default true) changes that to "everything except the negated pattern", leaking unrelated files through the adapter. Those stray resources propagated into the Link reader and caused a hard TypeError in ReaderCollectionPrioritized.

The fix

Three small edits in @ui5/fs:

1. FileSystem._runGlob — add expandNegationOnlyPatterns: false to the globby options object. Restores pre-16 semantics with a single line.
2. Link._byGlob — append .filter(Boolean) so any resource outside the mapped path is dropped rather than left as an undefined hole (defensive hardening).
3. FileSystem._runGlob — add the missing return after resolve(null) on the null-relPath branch (defensive hardening).

A regression test locks the negation-only semantics against future globby bumps.

No breaking change for third parties

@ui5/fs does not forward byGlob options to globby (by design), so task and middleware authors cannot inject globby options and are unaffected. We have analyzed ui5-community/ui5-ecosystem-showcase (12 tasks/middlewares) and confirmed zero direct globby dependencies and zero negation-only patterns.

[matz3]

LGTM