Skip to content

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 - #104

Merged
dnwe merged 1 commit into
mainfrom
dependabot/npm_and_yarn/picomatch-2.3.2
Sep 12, 2026
Merged

dnwe merged 1 commit into
mainfrom
dependabot/npm_and_yarn/picomatch-2.3.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps picomatch from 2.3.1 to 2.3.2.

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 12, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/picomatch-2.3.2 branch from a4c7f4b to 29a56f1 Compare September 12, 2026 09:34
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/picomatch-2.3.2 branch from 29a56f1 to 9fbd9d4 Compare September 12, 2026 11:19
@dnwe
dnwe merged commit 8041713 into main Sep 12, 2026
2 checks passed
@dnwe
dnwe deleted the dependabot/npm_and_yarn/picomatch-2.3.2 branch September 12, 2026 11:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant