chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2

[dependabot]

Bumps picomatch from 2.3.1 to 2.3.2.

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

• Fix bad text values in parse #126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #129, thanks to @​styfle
• Add sideEffects to package.json #128, thanks to @​frandiox
• Removed os, make compatible browser environment. See #124, thanks to @​gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[jonathanstumm]

PR Review — #23 chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2

Verdict: ✅ Approve

Summary

Dependabot security patch bumping picomatch from 2.3.1 → 2.3.2. This is a dev-only dependency (used transitively by test/build tooling). Changes are confined to package-lock.json.

What's fixed

• CVE-2026-33671 and CVE-2026-33672 — security-relevant issues in picomatch's glob pattern handling.
• Exception when glob pattern contains constructor (fix: exception when glob pattern contains constructor micromatch/picomatch#144).

Risk assessment

• Very low risk. Patch-level semver bump on a dev dependency. No application code changes. No impact on production bundle.
• The minor libc field removals in the lockfile for @biomejs/cli-* packages are lockfile format normalization — harmless.

Recommendation

Safe to merge. No further action needed.

---

Reviewed by Claude Code on behalf of @gordonagnew and @jonathanstumm

[gordonagnew]

PR Review — #23 chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2

Verdict: Approve ✅

Summary

Dependabot security patch bumping picomatch 2.3.1 → 2.3.2 (dev dependency only). Fixes two CVEs:

• CVE-2026-33671 — security fix
• CVE-2026-33672 — security fix
• Also fixes an exception when glob pattern contains constructor

Changes

• package-lock.json only — no source code changes
• picomatch version, resolved URL, and integrity hash updated
• Minor lockfile normalization (removed libc entries from some optional @esbuild/* packages — benign lockfile regeneration artifact)

Risk Assessment

• Low risk — patch-level bump of a dev-only dependency with no source changes
• No impact on production bundle or runtime behavior

Recommendation

Merge as-is. Standard security maintenance.

---

Reviewed by @agent-github-gordonagnew @agent-github-jonathanstumm

[jonathanstumm]

PR Review: chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2

Verdict: ✅ Approve

Summary

Straightforward Dependabot security patch bumping picomatch from 2.3.1 to 2.3.2. This is a dev dependency only — no production impact.

Changes

• package-lock.json only — no source code changes
• Bumps picomatch 2.3.1 → 2.3.2 (patch version, semver-compatible)
• Removes some libc fields from unrelated lockfile entries (normal lockfile regeneration noise)

Security Fixes

This release addresses two CVEs:

• CVE-2026-33671 — security fix in picomatch
• CVE-2026-33672 — security fix in picomatch
• Also fixes an exception when glob pattern contains constructor (prototype pollution vector)

Risk Assessment

• Risk: Very Low — patch-level bump of a dev-only dependency with no API changes
• No changes to application code or runtime dependencies
• Lockfile diff is minimal and expected

Recommendation

Safe to merge. Security patches for dev dependencies should be applied promptly.

---

Reviewers: @gordonagnew @jonathanstumm

[gordonagnew]

PR Review — #23 chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2

Verdict: Approve ✅

Summary

Dependabot security patch bumping picomatch 2.3.1 → 2.3.2. This is a dev-only dependency (used transitively by test/build tooling). The update fixes two CVEs:

• CVE-2026-33671 — security fix
• CVE-2026-33672 — security fix
• Also fixes an exception when glob patterns contain constructor

Diff Analysis

• Only package-lock.json changed (+3 / -15 lines)
• Version bump for picomatch entry (version, resolved URL, integrity hash)
• Removal of libc fields from 4 unrelated @rollup optional platform entries — this is normal lockfile regeneration noise, not a concern
• No source code changes, no new dependencies introduced

Risk Assessment

• Low risk — patch-level bump of a dev dependency with no source changes
• Semver-compatible, security-only release
• No impact on production bundle

Recommendation

Ship it. Security patch on a dev dependency with minimal diff.

---

Reviewed by Claude Code