Skip to content

chore(deps): bump picomatch in /demo/ui - #30

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/demo/ui/multi-dbdaea41c6
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/demo/ui/multi-dbdaea41c6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps and picomatch. These dependencies needed to be updated together.
Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

Updates picomatch from 4.0.3 to 4.0.7

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2026
@NathanCummings
NathanCummings enabled auto-merge (squash) September 17, 2026 12:03
@NathanCummings

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/demo/ui/multi-dbdaea41c6 branch 2 times, most recently from 466cb08 to 7413712 Compare September 17, 2026 12:09
Bumps  and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together.

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.3 to 4.0.7
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/demo/ui/multi-dbdaea41c6 branch from 7413712 to 3f73b9f Compare September 17, 2026 12:13
@dependabot @github

dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #34.

@dependabot dependabot Bot closed this Sep 17, 2026
auto-merge was automatically disabled September 17, 2026 12:13

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/demo/ui/multi-dbdaea41c6 branch September 17, 2026 12:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant