fix(deps): update picomatch (medium)

[claude]

Summary

• Update transitive dependency picomatch from 2.3.1 to 2.3.2 to resolve GHSA-3v7f-55p6-f55p (CVE-2026-33672, medium severity)
• The vulnerability involves method injection in POSIX character classes causing incorrect glob matching
• Only lockfiles modified — no code or manifest changes required since picomatch is a transitive dependency and existing semver ranges already allow 2.3.2

Lockfiles modified

• package-lock.json
• examples/connect-app-teleop-react/package-lock.json
• examples/node/package-lock.json
• examples/teleop-react/package-lock.json

Advisories resolved

• GHSA-3v7f-55p6-f55p (alerts Automated Protos Update #307, Bump braces from 3.0.2 to 3.0.3 in /examples/react-native #310, Update release workflow #311, RSDK-7470: Add GetProperties and CaptureAllFromCamera #312): picomatch < 2.3.2 — all 4 alerts resolved

Unresolved alerts

None — all alerts resolved.

Resolves #893

🤖 Generated with Claude Code

[claude]

Code Review: fix(deps): update picomatch (medium)

This PR correctly patches GHSA-3v7f-55p6-f55p by bumping picomatch from 2.3.1 → 2.3.2 across all affected lockfiles.

What looks correct

• All 4 lockfiles update node_modules/picomatch to 2.3.2.
• The semver ranges (^2.3.1) in dependents already allow 2.3.2 — no manifest change needed.
• The resolved URL and integrity hash (sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==) are consistent across all 4 lockfiles.
• src/gen/ is untouched.
• No source files or manifests (package.json) were modified.
• The examples/react-native lockfile was already at picomatch 2.3.2 and was correctly left alone.

Incidental lockfile drift (not a blocker)

The example lockfiles were fully regenerated rather than surgically patched (which is normal npm install behavior). This pulled in two additional changes not mentioned in the PR description:

1. SDK version references in example lockfiles updated from stale values (0.66.1 / 0.68.1) to the current release (0.68.2). This is correct — the lockfiles were behind.
2. flatted ^3.4.2 appears in the devDependencies metadata block for the parent package in examples/node and examples/teleop-react lockfiles. Confirmed that flatted was already added to the root package.json (line 80), so this is the lockfiles catching up to the current manifest.

These changes are all correct and benign — they reflect the true current state of the package. The PR description could be more precise ("lockfile regeneration picked up additional drift"), but this is documentation-only and not a code issue.

Verdict

The security fix is correct and complete. No issues requiring changes.