Skip to content

chore(deps): bump picomatch#356

Merged
siddharthkp merged 3 commits into
mainfrom
dependabot/npm_and_yarn/multi-5847bbe98b
Apr 2, 2026
Merged

chore(deps): bump picomatch#356
siddharthkp merged 3 commits into
mainfrom
dependabot/npm_and_yarn/multi-5847bbe98b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 25, 2026

Copy link
Copy Markdown
Contributor

Bumps and picomatch. These dependencies needed to be updated together.
Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Updates picomatch from 4.0.2 to 4.0.4

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump picomatch
b75eb0c 
Bumps  and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together.

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.2 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@changeset-bot

changeset-bot Bot commented Mar 25, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: c7bc425

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@siddharthkp

siddharthkp commented Mar 30, 2026

Copy link
Copy Markdown
Member

@siddharthkp

siddharthkp commented Apr 1, 2026

Copy link
Copy Markdown
Member

@copilot Why is the linter unhappy here?

Copilot AI commented Apr 1, 2026

Copy link
Copy Markdown
Contributor

@copilot Why is the linter unhappy here?

The linter fails because picomatch 2.3.2 changed the behavior of the +(|x) glob pattern syntax — it no longer matches anything. rollup-plugin-typescript2 v0.36.0 uses *.ts+(|x) and **/*.ts+(|x) as its include patterns to detect TypeScript source files. With 2.3.2, those patterns don't match *.ts or *.tsx files at all:

pm('*.ts+(|x)')('index.ts')   // false (worked in 2.3.1)
pm('*.ts+(|x)')('index.tsx')  // false (worked in 2.3.1)

Because the plugin can't find any source files to process, it silently skips declaration generation — so the build completes without errors but produces no .d.ts files. Then publint --strict fails because package.json references ./dist/esm/index.d.ts and ./dist/cjs/index.d.cts which don't exist.

The fix for rollup-plugin-typescript2 (replacing +(|x) with {,x}) was merged in #481 but isn't released yet, which is why the first comment suggests waiting before merging this picomatch bump.

Copilot AI requested a review from siddharthkp April 1, 2026 10:02
@siddharthkp siddharthkp self-assigned this Apr 1, 2026
@siddharthkp

siddharthkp commented Apr 2, 2026

Copy link
Copy Markdown
Member

@copilot #481 is now released in https://github.com/ezolenko/rollup-plugin-typescript2/releases/tag/0.37.0

@siddharthkp
fix: update rollup-plugin-typescript2 to 0.37.0 and fix tsconfig.buil…
c7bc425 
…d.json types

- Bump rollup-plugin-typescript2 from ^0.36.0 to ^0.37.0 which contains the
  picomatch 2.3.2 compatibility fix (replaces broken +(|x) patterns with {,x})
- Add "types": ["node"] to tsconfig.build.json to exclude test-only
  vitest-dom/extend-expect while keeping Node.js types for process.env usage

Agent-Logs-Url: https://github.com/primer/live-region-element/sessions/118d106c-3273-4ea7-91c2-858333c34c94

Co-authored-by: siddharthkp <1863771+siddharthkp@users.noreply.github.com>

Copilot AI commented Apr 2, 2026

Copy link
Copy Markdown
Contributor

@copilot #481 is now released in https://github.com/ezolenko/rollup-plugin-typescript2/releases/tag/0.37.0

Done in c7bc425. Bumped rollup-plugin-typescript2 to ^0.37.0 and also added "types": ["node"] to tsconfig.build.json — with 0.37.0 now properly performing type-checking, the build was failing because the build tsconfig inherited the test-only vitest-dom/extend-expect type from the base config. Setting "types": ["node"] excludes it while keeping Node.js types available for the process.env.NODE_ENV usage in the source.

@siddharthkp
siddharthkp merged commit ab34f61 into main Apr 2, 2026
7 checks passed
@siddharthkp
siddharthkp deleted the dependabot/npm_and_yarn/multi-5847bbe98b branch April 2, 2026 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@siddharthkp siddharthkp siddharthkp approved these changes

Assignees

@siddharthkp siddharthkp

Labels

dependencies skip changeset

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@siddharthkp @llastflowers