fix(SDK-6463): survive glob/minimatch crash from incompatible brace-expansion (0-test builds)

[Bhargavi-BS]

SDK-6463 (follow-up) — survive glob/minimatch crash from an incompatible brace-expansion

A customer whose repo force-resolves brace-expansion@5.0.5 (a security bump, via yarn resolutions / npm overrides) hit a hard crash in spec discovery:

TypeError: expand is not a function
  at Minimatch.braceExpand (node_modules/glob/node_modules/minimatch/minimatch.js:271:10)
  ...
  at exports.getNumberOfSpecFiles (bin/helpers/utils.js:1159)

Root cause (verified, reproduced)

The CLI depends on glob@^7.2.0 → minimatch@3, which imports brace-expansion as a callable default (const expand = require('brace-expansion')). brace-expansion@5.x is ESM-only-shaped for CJS: it exports { expand } with __esModule: true and no callable default, so expand(...) throws the moment a pattern contains braces ({js,ts,...} — which the Cypress default spec pattern always has).

Note: simply upgrading glob does not fix this — I reproduced that glob@10 → minimatch@9 also crashes with brace-expansion@5.0.5 (brace_expansion_1.default is not a function), because minimatch@9 reads the (absent) default export too. So the robust fix is to make the CLI resilient to a broken transitive glob, not to chase a compatible glob version against a dependency the consumer pins.

There was also a secondary bug that masked the real error: deleteBaseUrlFromError (called from the run's error handler) does err.replace(...) on what may be a non-string Error, throwing TypeError: err.replace is not a function.

Fix

• safeGlobSync wraps glob.sync: on failure it logs one clear, actionable warning (points at the brace-expansion/minimatch resolution) and returns [], so spec discovery and the run proceed (specs are resolved on BrowserStack regardless of the local count). All 4 glob.sync sites in utils.js now use it.
• Backstop try/catch around getNumberOfSpecFiles so it can never crash the run.
• deleteBaseUrlFromError guards non-string errors (typeof err === 'string' ? … : err) so the real failure is never masked.

Impact

Before: builds created with 0 executed tests, or the run crashes outright. After: the run proceeds and BrowserStack executes the specs (local parallelisation may be reduced if the count couldn't be computed, but tests run).

Validation

• Reproduced the real crash (glob@7/glob@10 + brace-expansion@5.0.5 → expand is not a function) and confirmed safeGlobSync degrades it to [] with no crash.
• Unit tests added: safeGlobSync and getNumberOfSpecFiles don't throw when glob.sync throws; deleteBaseUrlFromError leaves non-string errors unchanged (and still transforms strings). Suite: +3 passing, no new failures.

Scope

Separate branch/PR from the config-compile + accessibility-afterEach fixes (PR #1131), since this is a distinct root cause and can ship independently.

🤖 Generated with Claude Code