fix: upgrade picomatch to 4.0.4, 3.0.2, 2.3.2 (CVE-2026-33671)

[orbisai0security]

Summary

Upgrade picomatch from 2.3.1 to 4.0.4, 3.0.2, 2.3.2 to fix CVE-2026-33671.

Vulnerability

Field	Value
ID	CVE-2026-33671
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-33671
File	api-docs/pnpm-lock.yaml

Description: picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns

Changes

• api-docs/package.json
• api-docs/pnpm-lock.yaml

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 802e509. Configure here.}

[cursor]

Phantom direct dependency instead of pnpm override

Low Severity

picomatch is added as a direct production dependency, but no source file in api-docs actually imports or requires it — it's only a transitive dependency of anymatch and micromatch. The project already has a pnpm.overrides section used for exactly this purpose (e.g., lodash, form-data). Adding it to dependencies instead of pnpm.overrides is misleading and inconsistent with the existing pattern, and risks someone later removing it as "unused."

 

^{Reviewed by Cursor Bugbot for commit 802e509. Configure here.}