deps: Bump globby from 14.1.0 to 16.2.4

packages/fs/lib/adapters/FileSystem.js

@@ -67,6 +67,10 @@ class FileSystem extends AbstractAdapter {
 			onlyFiles: options.nodir,
 			followSymbolicLinks: false,
 			gitignore: this._useGitignore,
+			// globby >=16 expands a negation-only pattern list (e.g. ["!**/foo"]) to
+			// "everything except", whereas we rely on the pre-16 behavior of matching
+			// nothing when no positive pattern remains. Keep the old semantics.
+			expandNegationOnlyPatterns: false,
 		};
 		trace.globCall();
 
@@ -119,6 +123,7 @@ class FileSystem extends AbstractAdapter {
 							`Failed to resolve virtual path of glob match '${virPath}': Path must start with ` +
 							`the configured virtual base path of the adapter. Base path: '${this._virBasePath}'`);
 						resolve(null);
+						return; // Stop: relPath is null, do not attempt to stat it
 					}
 					const fsPath = this._resolveToFileSystem(relPath);
 

packages/fs/lib/readers/Link.js

@@ -105,7 +105,8 @@ class Link extends AbstractReader {
 					path: this._pathMapping.linkPath + resourcePath.substr(this._pathMapping.targetPath.length)
 				});
 			}
-		});
+			// Drop resources outside the mapped target path instead of leaking an undefined entry
+		}).filter(Boolean);
 	}
 
 	/**

packages/fs/package.json

@@ -59,7 +59,7 @@
 		"@ui5/logger": "^5.0.0-alpha.10",
 		"async-mutex": "^0.5.0",
 		"escape-string-regexp": "^5.0.0",
-		"globby": "^15.0.0",
+		"globby": "^16.2.4",
 		"graceful-fs": "^4.2.11",
 		"micromatch": "^4.0.8",
 		"minimatch": "^10.2.6",

packages/fs/test/lib/adapters/FileSystem_read.js

@@ -296,6 +296,23 @@ test("static excludes: glob library src and test with double negation", async (t
 	], "Found expected test resources");
 });
 
+// Regression: with globby >=16 a negation-only pattern list (positive pattern normalized
+// away, only the negated exclude left) must match nothing, not "everything except".
+// Guarded via expandNegationOnlyPatterns: false in FileSystem._runGlob.
+test("static excludes: query yielding a negation-only pattern list matches nothing", async (t) => {
+	const testReader = createAdapter({
+		fsBasePath: "./test/fixtures/library.l/test",
+		virBasePath: "/test-resources/",
+		excludes: ["/test-resources/**/.library"]
+	});
+
+	// ".library" exists only under /resources, so for this test adapter the positive
+	// pattern drops out and only the negated exclude remains.
+	const testResources = await testReader.byGlob("/resources/**/.library", {nodir: true});
+
+	t.is(testResources.length, 0, "Negation-only pattern list must not expand to all files");
+});
+
 test("static excludes: glob library test with double negation", async (t) => {
 	const excludes = [
 		"/test-resources/**",

packages/project/package.json

@@ -68,7 +68,7 @@
 		"ajv-errors": "^3.0.0",
 		"chalk": "^6.0.0",
 		"escape-string-regexp": "^5.0.0",
-		"globby": "^14.1.0",
+		"globby": "^16.2.4",
 		"graceful-fs": "^4.2.11",
 		"js-yaml": "^4.3.1",
 		"lockfile": "^1.0.4",