chore(deps): update dependency picomatch to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
picomatch	2.3.2 → 4.0.7

---

Release Notes

micromatch/picomatch (picomatch)

v4.0.7

Compare Source

Fixed

• Fixed terminal globstars in parenthesized patterns (#​142, e279bd7).

v4.0.6

Compare Source

Fixed

• scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#​62, 5f5819d).
• scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#​58, f201165).

v4.0.5

Compare Source

Fixed

• Preserved every branch when safely rewriting repeated extglobs (#​182, 6289307).
• Honored the windows option when matching basenames (#​183, ab8bc4d).

v4.0.4

Compare Source

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

v4.0.3

Compare Source

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in #​144

New Contributors

• @​Jason3S made their first contribution in #​144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

v4.0.2

Compare Source

v4.0.1

Compare Source

v4.0.0

Compare Source

Fixes

• Fix bad text values in parse #​126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #​129, thanks to @​styfle
• Add sideEffects to package.json #​128, thanks to @​frandiox
• Removed os, make compatible browser environment. See #​124, thanks to @​gwsbhqt

v3.0.2

Compare Source

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in #​144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@3.0.1...3.0.2

v3.0.1

Compare Source

Fixes

• Support stars in negation extglobs with expression after closing parenthesis #​102, thanks to @​mrmlnc

v3.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
8689	1	8688	73

View the top 1 failed test(s) by shortest run time

lib/dependency-security-pins.test.ts > dependency security pins > keeps the audited compatible major resolutions explicit

Stack Traces | 0.0195s run time

AssertionError: expected { '@babel/core': '7.29.7', …(11) } to match object { '@babel/core': '7.29.7', …(3) }
(8 matching properties omitted from actual)

- Expected
+ Received

  {
    "@babel/core": "7.29.7",
    "js-yaml": "4.3.0",
-   "picomatch": "2.3.2",
+   "picomatch": "4.0.5",
    "undici": "7.28.0",
  }

 ❯ lib/dependency-security-pins.test.ts:63:45

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}