docs(dependency-audit): recommend quoting glob targets for portable scripts

.changeset/quote-glob-targets.md

@@ -0,0 +1,5 @@
+---
+'@mawesome/dependency-audit': patch
+---
+
+Document quoting glob targets (e.g. `"./packages/*"`) in scripts so the CLI, not the shell, expands them — keeping the command portable across shells, including Windows.

apps/site/package.json

@@ -15,7 +15,7 @@
 	"dependencies": {
 		"@astrojs/starlight": "^0.39.3",
 		"@mawesome/dependency-audit": "workspace:*",
-		"astro": "^6.4.3",
+		"astro": "^6.4.7",
 		"nanotar": "^0.3.0",
 		"pathe": "^2.0.3"
 	},

packages/dependency-audit/README.md

@@ -33,8 +33,8 @@ dependency-audit ./my-lib-1.2.3.tgz
 dependency-audit lodash@4.17.21
 dependency-audit @sindresorhus/is@latest
 
-# Several at once (a glob is expanded by the CLI, so it works on Windows too)
-dependency-audit --json ./packages/*
+# Several at once — quote the glob so the CLI (not the shell) expands it, identically on every OS
+dependency-audit --json "./packages/*"
 ```
 
 Exit codes: `0` clean, `1` findings, `2` error. See the [CLI reference](./docs/cli.md) for every flag (including `--condition`, `--require-types`, and config files).

packages/dependency-audit/docs/cli.md

@@ -13,7 +13,7 @@ A **target** is one of:
 
 Multiple targets may be passed; each is audited independently and isolated — one target failing to acquire/audit reports as an error for that target and never discards the others.
 
-A path-shaped glob (e.g. `./packages/*`, `../../packages/*`) is expanded by the CLI itself, so it behaves the same on Windows — where `cmd.exe`/PowerShell don't expand globs — as in a POSIX shell. The base may use `.`, `..`, or be absolute. A pattern matching nothing is kept as-is, surfacing as a clear "not found" error, and a published spec or URL is never globbed, so `lodash@*` still resolves against the registry.
+A path-shaped glob (e.g. `./packages/*`, `../../packages/*`) is expanded by the CLI itself, so it behaves the same on Windows — where `cmd.exe`/PowerShell don't expand globs — as in a POSIX shell. **Quote the pattern** (`"./packages/*"`) in a script so a POSIX shell doesn't expand it first; then the CLI does the expansion identically on every OS (the result is the same either way, but quoting keeps the command portable). The base may use `.`, `..`, or be absolute. A pattern matching nothing is kept as-is, surfacing as a clear "not found" error, and a published spec or URL is never globbed, so `lodash@*` still resolves against the registry.
 
 A local path that **exists but is not an auditable package** — a non-tarball file, or a directory without a `package.json` — is **skipped** (a neutral `↷` notice), not treated as an error. This is what keeps a stray glob match (`packages/*` catching a `README.md`) from turning a findings run (exit 1) into an error run (exit 2). A path that does **not** exist, or a spec that fails to resolve, is still a hard error.
 
@@ -61,16 +61,16 @@ dependency-audit lodash@4.17.21
 dependency-audit @sindresorhus/is@latest
 
 # A whole monorepo's built packages, machine-readable, for CI
-dependency-audit --json ./packages/*
+dependency-audit --json "./packages/*"
 
 # Audit the browser export condition instead of the default Node profile
 dependency-audit --condition browser ./packages/my-lib
 
 # Treat "types not built / unreachable" as a hard failure
-dependency-audit --require-types ./packages/*
+dependency-audit --require-types "./packages/*"
 
 # Don't let an internal producer's type gap fail every consumer — fix the producer
-dependency-audit --collapse-root-cause ./packages/*
+dependency-audit --collapse-root-cause "./packages/*"
 
 # Suppress a known-intentional optional import
 dependency-audit --ignore optional-plugin --ignore react/jsx-runtime ./packages/my-lib
@@ -99,10 +99,10 @@ The CLI does not know about your repo layout — point it at the **built** packa
 
 ```sh
 pnpm -r exec dependency-audit .      # one process per package (simple, fully isolated)
-dependency-audit ./packages/*        # one process, bounded-concurrency, isolated per target
+dependency-audit "./packages/*"        # one process, bounded-concurrency, isolated per target
 ```
 
-The `./packages/*` form is expanded by the CLI when the shell doesn't (Windows `cmd.exe`), so the same command works everywhere.
+Quote the glob (`"./packages/*"`) so the CLI expands it rather than the shell — the same command then works everywhere, including Windows `cmd.exe`/PowerShell, which don't expand globs.
 
 Local `@scope/*` dependencies declared as `file:`/`workspace:`/`link:` are resolved by linking the already-built sibling, so you do not need to publish or rebuild siblings first — just build them.