From 61104fce09275c44e401bd958904d93b90e245bb Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Tue, 20 Oct 2026 16:10:01 -0700 Subject: [PATCH] Update picomatch (#29525) The playground's locked `picomatch` 2.3.1 has a security advisory. Update it to 2.3.2, which is outside the affected range. Updating `picomatch` also refreshes the other locked version from 4.0.4 to 4.0.7. Codex's analysis is that Renovate's missing [support for targeted updates of transitive dependencies in `package-lock.json`](https://github.com/renovatebot/renovate/issues/46379) may explain why it did not open a security update for the vulnerable `picomatch` version. Split from #29518. --- playground/package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/playground/package-lock.json b/playground/package-lock.json index 9f9e85c599..3cdea90b05 100644 --- a/playground/package-lock.json +++ b/playground/package-lock.json @@ -4139,9 +4139,9 @@ "license": "ISC" }, "node_modules/picomatch": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz", - "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==", + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", + "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", "dev": true, "license": "MIT", "engines": { @@ -4539,9 +4539,9 @@ } }, "node_modules/tinyglobby/node_modules/picomatch": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", - "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "engines": {