Skip to content

Bump picomatch from 2.3.1 to 4.0.4#207

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/picomatch-4.0.4
Open

Bump picomatch from 2.3.1 to 4.0.4#207
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/picomatch-4.0.4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 18, 2026

Bumps picomatch from 2.3.1 to 4.0.4.

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

New Contributors

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

3.0.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@3.0.1...3.0.2

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump picomatch from 2.3.1 to 4.0.4
bd86fac 
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 4.0.4.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...4.0.4)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels May 18, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 18, 2026 16:59
@dependabot dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels May 18, 2026
@dependabot dependabot Bot mentioned this pull request May 18, 2026
Closed
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 18, 2026

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 6 0 0 0.14s
❌ ACTION zizmor 6 1 0 0.23s
✅ JSON jsonlint 11 0 0 0.12s
✅ JSON npm-package-json-lint yes no no 0.44s
✅ JSON prettier 11 0 0 2.84s
✅ JSON v8r 11 0 0 11.16s
✅ MARKDOWN markdownlint 1 0 0 0.96s
✅ REPOSITORY checkov yes no no 22.78s
✅ REPOSITORY gitleaks yes no no 1.55s
✅ REPOSITORY git_diff yes no no 0.04s
❌ REPOSITORY grype yes 9 no 55.05s
❌ REPOSITORY osv-scanner yes 21 no 2.22s
✅ REPOSITORY secretlint yes no no 1.07s
✅ REPOSITORY syft yes no no 6.38s
✅ REPOSITORY trivy-sbom yes no no 3.23s
✅ REPOSITORY trufflehog yes no no 18.29s
✅ TYPESCRIPT eslint 30 0 0 7.81s
✅ TYPESCRIPT prettier 30 0 0 1.42s
✅ YAML prettier 18 0 0 0.86s
✅ YAML v8r 18 0 0 9.32s
✅ YAML yamllint 18 0 0 0.61s

Detailed Issues

❌ REPOSITORY / grype - 9 errors 
[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME        INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS           RISK   
handlebars  4.7.8      4.7.9     npm   GHSA-2w6w-674q-4c4q  Critical  0.2% (45th)    0.2    
handlebars  4.7.8      4.7.9     npm   GHSA-9cx6-37pm-9jff  High      < 0.1% (22nd)  < 0.1  
handlebars  4.7.8      4.7.9     npm   GHSA-3mfm-83xf-c92r  High      < 0.1% (14th)  < 0.1  
handlebars  4.7.8      4.7.9     npm   GHSA-2qvq-rjwj-gvw9  Medium    < 0.1% (19th)  < 0.1  
yaml        2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    < 0.1% (19th)  < 0.1  
handlebars  4.7.8      4.7.9     npm   GHSA-xhpv-hc6g-r9c6  High      < 0.1% (9th)   < 0.1  
handlebars  4.7.8      4.7.9     npm   GHSA-xjpj-3mr7-gcpf  High      < 0.1% (0th)   < 0.1  
handlebars  4.7.8      4.7.9     npm   GHSA-7rx3-28cr-v5wh  Medium    N/A            N/A    
handlebars  4.7.8      4.7.9     npm   GHSA-442j-39wm-28r2  Low       N/A            N/A
[0055] ERROR discovered vulnerabilities at or above the severity threshold
❌ REPOSITORY / osv-scanner - 21 errors 
Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 678 packages
End status: 41 dirs visited, 161 inodes visited, 1 Extract calls, 57.947118ms elapsed, 57.947268ms wall time

Total 8 packages affected by 21 known vulnerabilities (1 Critical, 11 High, 8 Medium, 1 Low, 0 Unknown) from 1 ecosystem.
21 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-2qvq-rjwj-gvw9 | 4.7  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-2w6w-674q-4c4q | 9.8  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-3mfm-83xf-c92r | 8.1  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-442j-39wm-28r2 | 3.7  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-7rx3-28cr-v5wh | 4.8  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-9cx6-37pm-9jff | 7.5  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xhpv-hc6g-r9c6 | 8.1  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xjpj-3mr7-gcpf | 8.2  | npm       | handlebars            | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash (dev)          | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash (dev)          | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)       | 3.1.2   | 3.1.4         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)       | 3.1.2   | 3.1.3         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)       | 3.1.2   | 3.1.3         | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)       | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)       | 9.0.3   | 9.0.6         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)       | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                  | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
❌ ACTION / zizmor - 1 error 
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/check-dist.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ZizmorLinter] Zizmor failed to reach the GitHub API.
To allow zizmor to use GITHUB_TOKEN, add the following to your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_ES,TYPESCRIPT_PRETTIER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependabot Dependabot issues and PRs npm Node.js issues and PRs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants