chore(deps): bump picomatch in /src/microsoft-trydotnet-editor

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps and picomatch. These dependencies needed to be updated together.
Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

• e5474fc Publish 4.0.4
• 4516eb5 Merge commit from fork
• 5eceecd Merge commit from fork
• 0db7dd7 Run benchmark again against latest minimatch version (#161)
• 9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
• 2661f23 fix typo in globstars.js test name (#138)
• 1798b07 docs: fix makeRe example (#143)
• 9d76bc5 chore: undocument removed options (#146)
• e4d718b Remove unused time-require (#160)
• 38dffeb chore(deps): pin dependencies (#158)
• Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

• e5474fc Publish 4.0.4
• 4516eb5 Merge commit from fork
• 5eceecd Merge commit from fork
• 0db7dd7 Run benchmark again against latest minimatch version (#161)
• 9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
• 2661f23 fix typo in globstars.js test name (#138)
• 1798b07 docs: fix makeRe example (#143)
• 9d76bc5 chore: undocument removed options (#146)
• e4d718b Remove unused time-require (#160)
• 38dffeb chore(deps): pin dependencies (#158)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🤖 Automated Major Version Review — APPROVED

Package: picomatch (multi-package)
Ecosystem: npm
Version changes: picomatch 2.3.1 → 2.3.2 and picomatch 4.0.3 → 4.0.4 (patch bumps in multi-package PR)

Research Summary

• Sources consulted:
  • https://github.com/micromatch/picomatch/releases — Release notes: 2.3.2 and 4.0.4 released together on 2026-03-23 as security patch releases
  • GHSA-3v7f-55p6-f55p — CVE-2026-33672 (Medium): Method injection vulnerability via POSIX_REGEX_SOURCE object — fixed in 2.3.2 and 4.0.4
  • GHSA-c2c7-rcm5-vvqj — CVE-2026-33671 (Low): ReDoS vulnerability via extglob patterns — fixed in 2.3.2 and 4.0.4
  • Request: backport security fix to 2.x line (CVE-2026-33671, CVE-2026-33672) micromatch/picomatch#165 — Confirms both CVEs are fixed in 2.3.2+ and 4.0.4+

Breaking Changes Analysis

Both 2.3.2 and 4.0.4 are security patch releases with no breaking changes. The only changes are security fixes for the two CVEs described below. No API changes were made.

Security Check

This update resolves two security vulnerabilities in the old version (picomatch 2.3.1 and 4.0.3):

• GHSA-3v7f-55p6-f55p / CVE-2026-33672 (Medium severity): Method injection via POSIX_REGEX_SOURCE. Can cause incorrect glob matching behavior in applications processing untrusted glob patterns. Fixed in 2.3.2 and 4.0.4.
• GHSA-c2c7-rcm5-vvqj / CVE-2026-33671 (Low severity): Regular Expression Denial of Service (ReDoS) via crafted extglob patterns. Fixed in 2.3.2 and 4.0.4.

Upgrading to the patched versions is a security improvement. Both 2.x and 4.x lines are updated to their respective patched versions.

Decision

✅ This multi-package update is safe to merge. CI checks pass, the diff contains only package-lock.json, no breaking changes were introduced, and this update resolves two known CVEs (CVE-2026-33672 and CVE-2026-33671) in the old versions.

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• security.snyk.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "security.snyk.io"

See Network Configuration for more information.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• #145 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Dependabot Major Version Reviewer · ● 2.6M · ◷