Skip to content

build(deps): Bump picomatch from 2.3.1 to 2.3.2 - #19

Merged
flex-development[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/picomatch-2.3.2
Sep 5, 2026
Merged

build(deps): Bump picomatch from 2.3.1 to 2.3.2#19
flex-development[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/picomatch-2.3.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 26, 2026

Copy link
Copy Markdown
Contributor

Bumps picomatch from 2.3.1 to 2.3.2.

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

@dependabot dependabot Bot added scope:dependencies dependency updates type:build changes to the build system or external dependencies labels Mar 26, 2026
@flex-development
flex-development Bot enabled auto-merge (squash) March 26, 2026 13:52
@github-project-automation github-project-automation Bot moved this to 🆕 New in docmark Mar 26, 2026
@unicornware
Lex (unicornware) force-pushed the main branch 3 times, most recently from 26ef7a6 to 57d0066 Compare June 24, 2026 04:33
@unicornware
Lex (unicornware) force-pushed the main branch 6 times, most recently from f6b7906 to af1689c Compare September 5, 2026 01:28
@unicornware

Copy link
Copy Markdown
Member

Dependabot (@dependabot) rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/picomatch-2.3.2 branch from 57f4a5d to 8ee3e0d Compare September 5, 2026 15:46
@codecov

codecov Bot commented Sep 5, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@codecov

codecov Bot commented Sep 5, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4463a73) to head (6f4ac80).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff            @@
##              main       #19   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           32        32           
  Lines          820       820           
  Branches       169       169           
=========================================
  Hits           820       820           
Flag Coverage Δ
bun-canary 100.00% <ø> (ø)
bun-latest 100.00% <ø> (ø)
node22 100.00% <ø> (ø)
node24 100.00% <ø> (ø)
node25 100.00% <ø> (ø)
node26 100.00% <ø> (ø)
Components Coverage Δ
docmark 100.00% <ø> (ø)
docmark-factory-space 100.00% <ø> (ø)
docmark-grammar 100.00% <ø> (ø)
docmark-util-combine-extensions 100.00% <ø> (ø)
docmark-util-subtokenize 100.00% <ø> (ø)
docmark-util-symbol 100.00% <ø> (ø)

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update de374b4...6f4ac80. Read the comment docs.

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@github-project-automation github-project-automation Bot moved this from 🆕 New to 🤩 Approved in docmark Sep 5, 2026
@unicornware

Copy link
Copy Markdown
Member

Dependabot (@dependabot) rebase

Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/picomatch-2.3.2 branch from 8ee3e0d to 6f4ac80 Compare September 5, 2026 15:52

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@flex-development
flex-development Bot merged commit 5178acb into main Sep 5, 2026
35 checks passed
@flex-development
flex-development Bot deleted the dependabot/npm_and_yarn/picomatch-2.3.2 branch September 5, 2026 15:55
@github-project-automation github-project-automation Bot moved this from 🤩 Approved to ✅ Done in docmark Sep 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scope:dependencies dependency updates type:build changes to the build system or external dependencies

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

1 participant