fix: update picomatch to resolve CVE-2026-33672

[dannyneira]

Summary

• Updates transitive picomatch entries in package-lock.json from 2.3.1 to 2.3.2 and from 4.0.2 to 4.0.4.
• Regenerates the bundled GitHub Action output in dist/.
• Resolves CVE-2026-33672 / GHSA-3v7f-55p6-f55p for both affected lockfile entries.

Vulnerability details

• Advisory: GHSA-3v7f-55p6-f55p
• Dependabot alerts:
  • https://github.com/warpdotdev/generate-changelog/security/dependabot/58
  • https://github.com/warpdotdev/generate-changelog/security/dependabot/60
• Ecosystem: npm
• Manifest: package-lock.json
• Dependency relationship: transitive development dependency
• Previous vulnerable versions: picomatch@4.0.2 and picomatch@2.3.1
• Patched versions: picomatch@4.0.4 and picomatch@2.3.2
• Workarounds: none; the lockfile updates stay within existing parent dependency ranges.

Verification

• npx --yes npm@8 ci
• npx --yes npm@8 audit --json confirmed no remaining picomatch vulnerability entries. Other unrelated existing alerts remain.
• npm run build
• npm run format-check
• npm run lint
• npm run package

Conversation: https://staging.warp.dev/conversation/0f640c51-fb81-47a6-b827-f9c5a2e1957b
Run: https://oz.staging.warp.dev/runs/019e36aa-7520-7c8d-ac1e-5ac0014872e1
This PR was generated with Oz.