chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the /apps directory: @humanfs/node and picomatch.

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

• Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

• e96070e chore: release main (#146)
• 22bbaa4 Merge commit from fork
• 956ce7a fix: Include type dependencies at runtime
• See full diff in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

• Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

• Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view