[MelvinBot]

Details

Bumps transitive picomatch 2.3.1 → 2.3.2 in package-lock.json to fix GHSA-c2c7-rcm5-vvqj (ReDoS, high) and GHSA-3v7f-55p6-f55p (method injection, medium). All dependents use ^2.x, so no package.json change.

Usage: Not imported in src, not shipped in dist. Dev/build tooling only: @babel/cli → chokidar (file globbing in npm run build), and the react-native peer's Metro/Jest/codegen (micromatch, jest-util).

Change Log

2.3.2 (security release):

• Fix exception when glob pattern contains constructor (fix: exception when glob pattern contains constructor micromatch/picomatch#144)
• Fix CVE-2026-33671 (GHSA-c2c7-rcm5-vvqj)
• Fix CVE-2026-33672 (GHSA-3v7f-55p6-f55p)

Full diff: micromatch/picomatch@2.3.1...2.3.2

Related Issues

https://github.com/Expensify/Expensify/issues/695893

Manual Tests

1. npm ci → installs cleanly.
2. npm ls picomatch → only 2.3.2.
3. npm run build → compiles all files to dist.
4. npx eslint src → no errors.

Steps 1–4 passed locally.

Linked PRs

None. Dev-only lockfile change, no release needed.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR