build(deps): bump picomatch and dependency-cruiser

[dependabot]

Bumps picomatch to 4.0.4 and updates ancestor dependency dependency-cruiser. These dependencies need to be updated together.

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Changelog

Sourced from picomatch's changelog.

4.0.4 (2026-03-23)

Security

• Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

Commits

• e5474fc Publish 4.0.4
• 4516eb5 Merge commit from fork
• 5eceecd Merge commit from fork
• 0db7dd7 Run benchmark again against latest minimatch version (#161)
• 9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
• 2661f23 fix typo in globstars.js test name (#138)
• 1798b07 docs: fix makeRe example (#143)
• 9d76bc5 chore: undocument removed options (#146)
• e4d718b Remove unused time-require (#160)
• 38dffeb chore(deps): pin dependencies (#158)
• Additional commits viewable in compare view

Updates dependency-cruiser from 17.3.1 to 17.4.3

Release notes

Sourced from dependency-cruiser's releases.

v17.4.3

👷 maintenance

• fbea056c build(npm): updates external dependencies

v17.4.2

📖 documentation

• ae0fcd40 doc: corrects typos

👷 maintenance

• ccef0faf chore(npm): sets ignore-scripts on ci
• ca1fe64a chore(npm): makes publishing staged only
• d4dad0e9/ 1d1bc84a/ ca1fe64a build(npm): updates external dependencies

v17.4.1

This release was created on github, but not published to npmjs

v17.4.0

✨ features

• af08fc4e feat(init): adds basic consistency check for typescript & babel features against transpiler availability (#1057)
• 74ce6904 feat(report): adds configuration option for err-* and markdown reporters to show unresolved module names in the to-part of violations (#1056)
• 3b620f28 feat(analyze): enriches violations with the unresolved module name and the dependency types (#1055)

👷 maintenance

• b333e0d3/ 1abe8808 build(npm): updates external dependencies

v17.3.10

👷 maintenance

• e401673d chore(npm): updates external dependencies Includes a bump of picomatch that has a vulnerability that is irrelevant for dependency-cruiser's context, but that nonetheless might trigger security scanners.

v17.3.9

👷 maintenance

• d91a8161 feat: allows usage with TypeScript v6 (#1049) - thanks @​fpapado for the pull request!
• e1843a64 build(npm): updates external dependencies

v17.3.8

🐛 fixes

• 273581d2 fix(extract/transpile): retains svelte(5+) dependencies used exclusively outside sections (#1046) - thanks @​Dan503 for raising the issue and verifying the fix!

👷 maintenance

• f86b5fac build(npm): updates external dependencies

... (truncated)

Commits

• 2584d9e 17.4.3
• fbea056 build(npm): updates external dependencies
• 6434625 17.4.2
• 1759529 chore(ci): simplifies release flow again
• 56e501f 17.4.1
• ccef0fa chore(npm): sets ignore-scripts on ci
• ca1fe64 chore(npm): makes publishing staged only
• b5b2c36 build(npm): updates external dependencies
• 1d1bc84 build(npm): updates external dependencies
• ae0fcd4 doc: corrects typos
• Additional commits viewable in compare view

[martastn]

Verdict: Safe to merge

Bump: picomatch 4.0.3 → 4.0.4 (patch, transitive via dependency-cruiser) + dependency-cruiser 17.3.1 → 17.4.3 (minor, direct devDependency)

Changes:

• picomatch: fixes CVE-2026-33671 (ReDoS on nested extglobs, GHSA-c2c7-rcm5-vvqj, high) and CVE-2026-33672 (POSIX class prototype lookup, GHSA-3v7f-55p6-f55p, medium). The 23 nested picomatch@2.3.2 copies (Jest 27, micromatch, anymatch, readdirp) are already the patched 2.x release (build(deps): bump picomatch from 2.3.1 to 2.3.2 #2349). No API/engines changes
• dependency-cruiser: perf work, drops ajv/memoize, opt-in reporter/init features. No engines/peer changes
• Lockfile also moves shared webpack-toolchain deps: enhanced-resolve 5.18.3 → 5.22.1, tapable 2.2.1 → 2.3.3, acorn 8.15.0 → 8.16.0, semver 7.7.3 → 7.8.1

Usage in repo: not imported; only npm run depcruise:high|low (not in CI). The shared deps are used by react-scripts' webpack

Impact: none. Production build is identical to master (128 files; only diff is the absolute checkout path baked in via import.meta.url, bundle Δ 0 kB). depcruise output (archi graphs, rule check, module JSON) identical

Verified:

• tsc ✅ · tests ✅ (same as master: 38 passed with app on :3000; ProjectMenu Selenium test is flaky on both, 1/4 green each) · build ✅ (bundle Δ 0 kB) · npm audit 88 → 86
• Manual UI/functional diff vs master (DOM + computed-style fingerprint + screenshots): examples, 3D editor (select/add/DnD), export/import, Pyodide converter (identical output), JSROOT results (identical SVG), menus, tooltips/hover, light/dark, mobile width, console, network. No differences