Skip to content

build(deps-dev): bump picomatch from 2.3.1 to 2.3.2 - #1601

Merged
Hyperkid123 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/picomatch-4.0.4
Nov 3, 2026
Merged

Hyperkid123 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/picomatch-4.0.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 15, 2026 •

Copy link
Copy Markdown
Contributor

Bumps picomatch from 2.3.1 to 2.3.2.

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Dependency PR javascript Pull requests that update javascript code labels May 15, 2026
@vercel

vercel Bot commented May 15, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
react-forms Ready Ready Preview Nov 3, 2026 2:18pm UTC

@Hyperkid123

Copy link
Copy Markdown
Member

@dependabot rebase

Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps-dev): bump picomatch from 2.3.1 to 4.0.4 build(deps-dev): bump picomatch from 2.3.1 to 2.3.2 Nov 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/picomatch-4.0.4 branch from b50d174 to 829a870 Compare November 3, 2026 14:07

@Hyperkid123 Hyperkid123 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

automated approval: green CI after rebase, no conflicts

@Hyperkid123
Hyperkid123 merged commit a27a146 into master Nov 3, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/picomatch-4.0.4 branch November 3, 2026 15:08

This branch was successfully deployed

1 active deployment
Preview — 829a870c Deployed Nov 3, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency PR javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant