[Copilot]

Dependabot’s security update job could not remediate picomatch because this repo’s Parcel watcher chain resolved micromatch@4.0.5 to vulnerable picomatch@2.3.1, while the first safe 2.x release is 2.3.2. This change makes that transitive resolution explicit so Dependabot can produce a valid update.

• Dependency resolution

  • Add a pnpm scoped override for micromatch>picomatch to force 2.3.2
  • Keep the fix narrowly targeted to the vulnerable transitive edge instead of changing Parcel or watcher versions

• Lockfile alignment

  • Mirror the override in pnpm-lock.yaml
  • Update the micromatch@4.0.5 snapshot to resolve picomatch: 2.3.2
  • Replace the old picomatch@2.3.1 lock entry with 2.3.2

• Result

  • Dependabot can now resolve the affected dependency graph to a non-vulnerable picomatch version

{
  "pnpm": {
    "overrides": {
      "micromatch>picomatch": "2.3.2"
    }
  }
}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 11de7d76-126e-45a9-abb2-00f094fb12f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The manifest and lockfile changes are consistent, narrowly scoped, and remove all picomatch@2.3.1 references.

Review effort: Balanced
Findings: None

What changed in this PR

Pins the vulnerable transitive picomatch dependency used by Parcel’s watcher chain.

Changes:

• Adds a scoped pnpm override for micromatch>picomatch.
• Aligns lockfile resolution to picomatch@2.3.2.

File	Description
package.json	Declares the scoped dependency override.
pnpm-lock.yaml	Records the override and updated resolution.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.