fix: update picomatch 4.0.3 → 4.0.4 (#43) #45

Merged

maximus merged 1 commit from issue-43-update-picomatch into main

2026-03-30 01:14:19 +00:00

maximus commented

2026-03-30 01:09:46 +00:00

Owner

Fixes #43

Summary

Updates picomatch from 4.0.3 to 4.0.4 via npm audit fix
Resolves 2 HIGH severity vulnerabilities (method injection + ReDoS)
Only package-lock.json changed — transitive dependency of vite

Test plan

npm audit returns 0 vulnerabilities
npm run build succeeds
No changes to package.json

Fixes #43 ## Summary - Updates picomatch from 4.0.3 to 4.0.4 via `npm audit fix` - Resolves 2 HIGH severity vulnerabilities (method injection + ReDoS) - Only `package-lock.json` changed — transitive dependency of vite ## Test plan - [x] `npm audit` returns 0 vulnerabilities - [x] `npm run build` succeeds - [x] No changes to `package.json`

maximus added 1 commit 2026-03-30 01:09:47 +00:00

fix: update picomatch 4.0.3 → 4.0.4 to resolve HIGH vulnerabilities (#43 ) 99dc78ab15

Fixes GHSA-3v7f-55p6-f55p (method injection) and GHSA-c2c7-rcm5-vvqj (ReDoS).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

maximus commented

2026-03-30 01:11:23 +00:00

Author

Owner

Review: APPROVE

Straightforward transitive dependency update fixing 2 HIGH severity vulnerabilities (method injection + ReDoS) in picomatch. The diff is minimal and limited to package-lock.json — no application code changes, no risk of regression.

Checklist:

No secrets or credentials
No injection vectors
Logic matches stated intent
No regressions
No SQL migration changes
Consistent with project conventions

No blocking issues. Good to merge.

Reviewed by Claude Code

## Review: APPROVE Straightforward transitive dependency update fixing 2 HIGH severity vulnerabilities (method injection + ReDoS) in picomatch. The diff is minimal and limited to `package-lock.json` — no application code changes, no risk of regression. Checklist: - [x] No secrets or credentials - [x] No injection vectors - [x] Logic matches stated intent - [x] No regressions - [x] No SQL migration changes - [x] Consistent with project conventions No blocking issues. Good to merge. --- *Reviewed by Claude Code*