micromatch picomatch

• CVE-2026-112366 High 7.5 Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns 0.3%
• CVE-2026-33672 Medium 5.3 Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 0.4%
• CVE-2026-33671 High 7.5 Picomatch has a ReDoS vulnerability via extglob quantifiers 0.4%