Possible fix(deps): picomatch 4.0.3 → 4.0.4, 3.0.2, 2.3.2 (CVE-2026-33671) in package-lock.json

[begininvoke]

Came across something in browser-metro/package-lock.json around line 111 that looked worth flagging.

picomatch v4.0.3 contains a Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-33671). Crafted extglob patterns trigger catastrophic backtracking, causing excessive CPU consumption and blocking the Node.js event loop when processing untrusted input. Risk Level: HIGH. Immediate version upgrade is required, especially if glob patterns originate from end-users or external sources.

Something like this might fix it:

--- a/browser-metro/package.json
+++ b/browser-metro/package.json
@@ -10,5 +10,5 @@
  "dependencies": {
-    "picomatch": "^4.0.3"
+    "picomatch": "^4.0.4"
  }

**Remediation:** Update package.json and run `npm install` or `yarn install` to regenerate package-lock.json with v4.0.4+. Verify with `npm ls picomatch`. If upgrade is temporarily blocked, mitigate by validating/sanitizing untrusted inputs and disabling extglob: `picomatch(pattern, { noextglob: true })`.

For reference: rule CVE-2026-33671. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.