fix(client): drop over-broad minimatch resolution so glob@10/11 get GLOBSTAR (fixes storybook) (#41949)

## Problem

`storybook-tests` fails. There are two independent layers, both fixed
here.

### Layer 1 — `GLOBSTAR` build failure
The Storybook preview build fails with:
`SyntaxError: The requested module 'minimatch' does not provide an
export named 'GLOBSTAR'`

**Root cause:** the `resolutions` block in `app/client/package.json` had
an over-broad blanket `"minimatch": "^5.1.8"` that force-downgraded
*every* minimatch to 5.x — including `glob@10` / `glob@11` (ESM), which
require minimatch 9/10 for the `GLOBSTAR` named export.

**Fix:** replaced the blanket with the specific `minimatch@^3.x ->
^5.1.8` pins (the CVE-2022-3517 ReDoS remediation, including the exact
`3.0.4` consumer). Resulting resolution:
- `glob@11 -> minimatch 10.2.5`, `glob@10 -> 9.0.9` (GLOBSTAR export
present)
- `glob 7/8 -> 5.1.9` (unchanged)
- all minimatch `>= 3.0.5` (no CVE regression — a bare blanket removal
would have reintroduced vulnerable `3.0.4`, which these pins prevent)

### Layer 2 — test-runner OOM
Once the build works, `test-storybook:ci` runs the Jest + Playwright
test-runner, which exceeds Node's ~2GB default old-space heap and dies
with `JavaScript heap out of memory` (exit 129). Added
`NODE_OPTIONS=--max-old-space-size=8192` to the Storybook Tests step.

## Verification (local, Node 24)
- `yarn install --immutable` clean
- Resolved minimatch all `>= 3.0.5` (no vulnerable version)
- Storybook builds clean (no `GLOBSTAR` error), `storybook-static`
artifact produced
- `glob 7/8` (used by the webpack client build) unchanged, so the client
build is unaffected

## Context
The identical fix landed in the EE repo (`appsmith-ee`) to unblock its
CI; the blanket resolution is identical in CE, so CE's Storybook is
broken the same way. Landing it here makes the fix durable (the CE->EE
sync converges the two) and fixes CE's own Storybook.

**Merge with a merge commit — do not squash** (preserves CE<->EE sync
history).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Automation
/ok-to-test tags="@tag.All"

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Increased the memory limit for Storybook tests in CI to help them run
more reliably.
* Updated dependency resolution settings to keep compatible versions of
a transitive package pinned consistently.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/28718473128>
> Commit: 9fc1f09
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28718473128&attempt=1"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.All`
> Spec:
> <hr>Sat, 04 Jul 2026 21:26:14 UTC
<!-- end of auto-generated comment: Cypress test results  -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: salevine

.github/workflows/test-storybook.yml

@@ -44,6 +44,11 @@ jobs:
 
       - name: Storybook Tests
         working-directory: ./app/client/packages/storybook
+        env:
+          # The Storybook test-runner (Jest + Playwright over every story) exceeds
+          # Node's ~2GB default old-space heap on the runner and OOMs (exit 129).
+          # Raise the limit; the runner has ample RAM.
+          NODE_OPTIONS: --max-old-space-size=8192
         run: |
           yarn build-storybook
           yarn test-storybook:ci

app/client/package.json

@@ -417,7 +417,14 @@
     "fast-csv": "4.3.6",
     "json-schema": "0.4.0",
     "node-fetch": "2.6.7",
-    "minimatch": "^5.1.8",
+    "minimatch@^3.0.3": "^5.1.8",
+    "minimatch@^3.0.4": "^5.1.8",
+    "minimatch@^3.0.5": "^5.1.8",
+    "minimatch@^3.1.1": "^5.1.8",
+    "minimatch@^3.1.2": "^5.1.8",
+    "minimatch@~3.0.2": "^5.1.8",
+    "minimatch@~3.0.4": "^5.1.8",
+    "minimatch@3.0.4": "^5.1.8",
     "loader-utils": "^2.0.4",
     "json5": "2.2.3",
     "dns-packet": "5.4.0",

app/client/yarn.lock

@@ -25988,7 +25988,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimatch@npm:^5.1.8":
+"minimatch@npm:^10.1.1":
+  version: 10.2.5
+  resolution: "minimatch@npm:10.2.5"
+  dependencies:
+    brace-expansion: ^5.0.5
+  checksum: 000423875fecbc7da1d74bf63c9081363a71291ef2588c376c45647ac004582cb5bc8cc09ef84420b26bfb490f4d0818d328e78569c6228e20d90271283f73ba
+  languageName: node
+  linkType: hard
+
+"minimatch@npm:^3.0.2":
+  version: 3.1.5
+  resolution: "minimatch@npm:3.1.5"
+  dependencies:
+    brace-expansion: ^1.1.7
+  checksum: 47ef6f412c08be045a7291d11b1c40777925accf7252dc6d3caa39b1bfbb3a7ea390ba7aba464d762d783265c644143d2c8a204e6b5763145024d52ee65a1941
+  languageName: node
+  linkType: hard
+
+"minimatch@npm:^5.0.1, minimatch@npm:^5.1.8":
   version: 5.1.9
   resolution: "minimatch@npm:5.1.9"
   dependencies:
@@ -25997,6 +26015,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"minimatch@npm:^9.0.4":
+  version: 9.0.9
+  resolution: "minimatch@npm:9.0.9"
+  dependencies:
+    brace-expansion: ^2.0.2
+  checksum: 5292681ba1e14544ca9214ba5e412bb346214fb783354b22752f2d1e5c176e4a2c0bfcafeb1046389b816009ab73ba5410b176ce605632e8aa695db25f87f6b9
+  languageName: node
+  linkType: hard
+
 "minimist@npm:^1.1.0, minimist@npm:^1.1.1, minimist@npm:^1.2.0, minimist@npm:^1.2.3, minimist@npm:^1.2.5, minimist@npm:^1.2.6, minimist@npm:^1.2.8":
   version: 1.2.8
   resolution: "minimist@npm:1.2.8"