Bump glob to v13 and rollup to v4.59+ to fix security vulnerabilities

Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>

plugins/catalog-backend/package.json

@@ -85,7 +85,7 @@
     "fast-json-stable-stringify": "^2.1.0",
     "fs-extra": "^11.2.0",
     "git-url-parse": "^15.0.0",
-    "glob": "^7.1.6",
+    "glob": "^13.0.0",
     "knex": "^3.0.0",
     "lodash": "^4.17.21",
     "luxon": "^3.0.0",
@@ -107,7 +107,6 @@
     "@types/core-js": "^2.5.4",
     "@types/express": "^4.17.6",
     "@types/git-url-parse": "^9.0.0",
-    "@types/glob": "^8.0.0",
     "@types/lodash": "^4.14.151",
     "@types/supertest": "^2.0.8",
     "better-sqlite3": "^12.0.0",

plugins/catalog-backend/src/processors/FileReaderProcessor.ts

@@ -15,9 +15,8 @@
  */
 
 import fs from 'fs-extra';
-import g from 'glob';
+import { glob } from 'glob';
 import path from 'node:path';
-import { promisify } from 'node:util';
 import { LocationSpec } from '@backstage/plugin-catalog-common';
 import {
   CatalogProcessor,
@@ -26,8 +25,6 @@ import {
   processingResult,
 } from '@backstage/plugin-catalog-node';
 
-const glob = promisify(g);
-
 const LOCATION_TYPE = 'file';
 
 /** @public */