fix: bump picomatch to resolve high severity audit

[chitcommit]

Summary

• Bump picomatch to patched version via npm audit fix
• Resolves GHSA-c2c7-rcm5-vvqj (ReDoS via extglob quantifiers)
• Resolves GHSA-3v7f-55p6-f55p (method injection in POSIX character classes)
• Unblocks CI npm audit --audit-level=high step for all open PRs (fix: address PR #68 review — silent failures, path traversal, dead code #69, fix: harden litigation AI pipeline — QC false-clear, empty response, source tracing #70)

Test plan

• npm audit --audit-level=high passes with 0 vulnerabilities
• CI build job passes

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b711c1ed-4e73-425b-bcfa-cca46c5c8ead

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/audit-picomatch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

1. @coderabbitai review
2. @copilot review
3. @codex review
4. @claude review
   Adversarial review request: evaluate security, policy bypass paths, regression risk, and merge-gating bypass attempts.

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.