chore(deps-dev): bump rimraf from 3.0.2 to 6.1.3

[dependabot]

Bumps rimraf from 3.0.2 to 6.1.3.

Changelog

Sourced from rimraf's changelog.

6.1

• Move to native fs/promises usage instead of promisifying manually.

6.0

• Drop support for nodes before v20
• Add --version to CLI

5.0

• No default export, only named exports

4.4

• Provide Dirent or Stats object as second argument to filter

4.3

• Return boolean indicating whether the path was fully removed
• Add filter option
• bin: add --verbose, -v to print files as they are deleted
• bin: add --no-verbose, -V to not print files as they are deleted
• bin: add -i --interactive to be prompted on each deletion
• bin: add -I --no-interactive to not be prompted on each deletion
• 4.3.1 Fixed inappropriately following symbolic links to directories

v4.2

• Brought back glob support, using the new and improved glob v9

v4.1

• Improved hybrid module with no need to look at the .default dangly bit. .default preserved as a reference to rimraf for compatibility with anyone who came to rely on it in v4.0.
• Accept and ignore -rf and -fr arguments to the bin.

v4.0

• Remove glob dependency entirely. This library now only accepts actual file and folder names to delete.
• Accept array of paths or single path.
• Windows performance and reliability improved.
• All strategies separated into explicitly exported methods.
• Drop support for Node.js below version 14
• rewrite in TypeScript

... (truncated)

Commits

• f738c78 6.1.3
• a164a85 update deps
• 4635ba7 update deps
• 509c53f limit ci workflow permissions
• 68ce04f formatting
• 37680c5 add warning to not pass untrusted input to this method ever
• 786563d remove contributing doc, already covered by .github repo
• dbeef73 contributing
• 84d27af update workflows and standard project junk
• cd45498 6.1.2
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for rimraf since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

---

Note

Medium Risk
Major dev-dependency jump on build-time file deletion with no accompanying import/API updates in the diff; verify production builds and postinstall still succeed.

Overview
Bumps the root devDependency rimraf from 3.0.2 to 6.1.3 and refreshes yarn.lock so the direct install resolves to rimraf 6 (with glob ^13 and package-json-from-dist). Older rimraf@3 can still appear in the lockfile for other packages.

There are no application or script edits in this diff. Existing callers (scripts/prebuild.js, DeleteSourceMaps.js, DeleteDistWeb.js, configs/webpack.config.main.prod.ts, redisinsight/ui/vite.config.mjs) still rely on rimraf.sync and glob-style paths for dist / source-map cleanup. The repo already requires Node >=24.x, which aligns with rimraf 6’s Node 20+ support.

Reviewers should watch CI/build and yarn install: rimraf 5+ dropped the default export (Vite uses a default import), and v6 may run a prepare script on install per upstream release notes.

^{Reviewed by Cursor Bugbot for commit 9f54f65. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[jit-ci]

🛡️ Jit Security Scan Results

✅ No security findings were detected in this PR

---

^{Security scan by Jit}

[cursor]

Legacy rimraf API breaks builds

High Severity

Raising the root devDependency to rimraf v6 leaves existing CommonJS build helpers on the v3 pattern (require('rimraf') and rimraf.sync). From v5 onward that default-export/sync usage is unsupported, so steps like scripts/prebuild.js and scripts/DeleteSourceMaps.js (pulled in by build:main / packaging) can throw at runtime instead of cleaning output dirs.

 

^{Reviewed by Cursor Bugbot for commit bfa613a. Configure here.}

[cursor]

Wildcard paths need glob option

Medium Severity

With root rimraf at v6, DeleteSourceMaps still passes paths containing * to rimraf.sync without enabling glob expansion. v6 treats paths as literal names unless { glob: true } (or CLI -g) is set, so *.js.map cleanup during main webpack builds may no longer remove source maps.

 

^{Reviewed by Cursor Bugbot for commit bfa613a. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bfa613a134

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep glob deletes working after rimraf upgrade

This upgrade changes the behavior used by existing cleanup scripts: rimraf v4+ requires the glob option for wildcard paths, but scripts/DeleteSourceMaps.js:5-6 still calls rimraf.sync(.../*.js.map) without options and is run by the Electron main webpack configs. After installing 6.1.3 those patterns are treated as literal paths, so stale UI source-map artifacts that v3 removed can be left behind during build/package workflows; update the calls to pass { glob: true } or avoid wildcard paths before taking this bump.

Useful? React with 👍 / 👎.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9f54f65. Configure here.}

[cursor]

rimraf v6 API mismatch

High Severity

Raising rimraf to ^6.1.3 without updating callers leaves v3-style require('rimraf') plus rimraf.sync, default ESM imports, and wildcard paths unchanged. v6 exposes named exports like rimrafSync, drops rimraf.sync, and only expands globs when { glob: true } is set, so packaging and main webpack builds can throw or skip intended deletions.

 

^{Reviewed by Cursor Bugbot for commit 9f54f65. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f54f65e89

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Replace the rimraf default import before bumping

This version is no longer compatible with redisinsight/ui/vite.config.mjs:13, which still does import rimraf from 'rimraf'; rimraf v5+ only exposes named exports, so after this dependency resolves to 6.1.3, any yarn --cwd redisinsight/ui dev/build or root build:ui/build:renderer path that loads the Vite config fails before the app builds. Please update the config to use a named export such as rimrafSync/rimraf as part of the bump.

Useful? React with 👍 / 👎.