[MelvinBot]

Details

Bumps picomatch 2.3.1 → 2.3.2 (lockfile only) to fix open Dependabot ReDoS / method-injection alerts.

Usage: Dev-only, transitive glob matcher via micromatch, anymatch, readdirp (@babel/cli in npm run build) and jest-util (Metro, from the react-native peer). Not shipped to consumers.

Change Log

• 2.3.2: Fix ReDoS via extglob quantifiers (CVE-2026-33671, GHSA-c2c7-rcm5-vvqj)
• 2.3.2: Fix method injection in POSIX character classes (CVE-2026-33672, GHSA-3v7f-55p6-f55p)
• 2.3.2: Fix exception when a glob contains constructor (fix: exception when glob pattern contains constructor micromatch/picomatch#144)

Related Issues

$ https://github.com/Expensify/Expensify/issues/695875

Manual Tests

1. npm ci succeeds and node_modules/picomatch is 2.3.2.
2. npm run lint passes.
3. npm run ts passes.
4. npm run build compiles src to dist.

Linked PRs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[NicolasBonet]

@MelvinBot sign the CLA

[MelvinBot]

I have read the CLA Document and I hereby sign the CLA

[inimaga]

@NicolasBonet I think you might also need to approve this PR for the verify peer review workflow to pass.

[chiragsalian]

Archiving this repository so closing out this PR