fix: honor declared picomatch override in lockfile

[groupthinking]

Problem

The root package.json declares:

"overrides": { "picomatch": "^4.0.5" }

…but the lockfile did not honor it. picomatch resolved to 4.0.4 at the root, while three redundant nested 4.0.5 copies were carried under tinyglobby, vite and vitest.

npm ls --all flagged the root node as invalid.

Found while verifying the security work in #1100 / #1101 / #1102.

Why npm ci did not catch this

npm ci only checks that the declared ranges in the manifest match those recorded in the lockfile — and they did. The defect is in the lockfile's resolved node versions, which violate the declared override. That is only surfaced by npm ls, never by npm ci.

Worth knowing on its own: it means CI is structurally blind to this class of drift.

Change

Lockfile-only. Hoist picomatch to a single 4.0.5 node and drop the three duplicate nested copies.

No manifest files are touched.

package-lock.json | 45 +++++----------------------------
1 file changed, 3 insertions(+), 42 deletions(-)

Verification

check	result
npm ci --legacy-peer-deps	exit 0
npm run build:web	exit 0
apps/web → npm run lint	exit 0
picomatch glob-matching behaviour	4/4 cases pass
npm ls --all reports picomatch invalid	no longer

Behavioural check run against the installed node — glob matching is picomatch's entire job, and vite / vitest / tinyglobby are the consumers:

version: 4.0.5
PASS  src/**/*.ts   <- src/a/b/c.ts  => true
PASS  *.js          <- a.js          => true
PASS  *.js          <- a/b.js        => false
PASS  **/{a,b}.txt  <- x/a.txt       => true

Scope

This does not fix the six pre-existing apps/web drift markers, which are a separate and larger problem:

@opentelemetry/api@1.9.0    invalid: "1.9.1"
@sentry/nextjs@10.65.0      invalid: "^10.66.0"
@stripe/stripe-js@9.9.0     invalid: "^9.10.0"
@tailwindcss/postcss@4.3.2  invalid: "^4.3.3"
autoprefixer@10.5.2         invalid: "^10.5.4"
tailwindcss@4.3.2           invalid: "^4.3.3"

Those need a full lockfile regeneration rather than a surgical edit, so they are filed separately rather than bundled in here.

Risk

Low. Lockfile-only, no manifests changed, and it brings the tree into compliance with an already-declared override rather than introducing a new constraint. 4.0.5 was already installed in three places in this same tree.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Building	Preview, v0	Jul 30, 2026 12:27pm

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ae85cd8.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/picomatch	4.0.5	🟢 6.1	Details Check Score Reason Code-Review 🟢 3 Found 7/21 approved changesets -- score normalized to 3 Maintained 🟢 9 10 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 2 SAST tool is not run on all commits -- score normalized to 2

Scanned Files

• package-lock.json

[github-actions]

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

Machine-readable verdict

{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 88ed39f6-ea46-448d-9c8c-a6728cbfaffb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[linear-code]

GRV-186

[groupthinking]

The six pre-existing apps/web drift markers noted under Scope are now tracked in #1110, with the registry evidence, the three failed remediation attempts, and the warning that npm install <pkg> -w apps/web loosens the manifest rather than fixing the tree.