chore(devtools): bump launch-editor and picomatch to fix security advisories

[renantatsuo]

🎯 Changes

Bumps two dependencies in @tanstack/devtools-bundler-core to pull in fixes for four security advisories:

• launch-editor: ^2.11.1 -> ^2.14.1 - updates its transitive shell-quote dependency from 1.8.3 to 1.10.0, fixing:
  • GHSA-w7jw-789q-3m8p
  • GHSA-395f-4hp3-45gv
• picomatch: ^4.0.3 -> ^4.0.5, fixing:
  • GHSA-c2c7-rcm5-vvqj
  • GHSA-3v7f-55p6-f55p

No source code changes, dependency bumps only, both within their current major versions.

Note: a shell-quote@1.8.3 entry remains in the lockfile, but it is only reachable through @rspack/dev-server in the react-rspack-example app's devDependencies, it does not affect any published package.

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested this code locally with pnpm test:pr.

🚀 Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

Summary by CodeRabbit

• Bug Fixes

  • Updated bundled dependencies to address reported security advisories.
  • Improved security and maintenance through updated dependency versions.

• Chores

  • Scheduled a patch release for the developer tools bundler package.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 125d8dce-a205-4697-b04e-2a3b967d7d52

📥 Commits

Reviewing files that changed from the base of the PR and between bcae55c and 3184d79.

📒 Files selected for processing (1)

• .changeset/olive-experts-look.md

🚧 Files skipped from review as they are similar to previous changes (1)

• .changeset/olive-experts-look.md

---

📝 Walkthrough

Walkthrough

The PR updates launch-editor and picomatch in @tanstack/devtools-bundler-core and adds a patch Changeset that documents the updates and the remaining development-only shell-quote dependency.

Changes

Dependency security updates

Layer / File(s)	Summary
Update dependency ranges and release metadata packages/devtools-bundler-core/package.json, .changeset/olive-experts-look.md	Updates launch-editor to ^2.14.1 and picomatch to ^4.0.5. Adds a patch Changeset for @tanstack/devtools-bundler-core and documents the remaining development-only shell-quote@1.8.3 path.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the two dependency updates and their security purpose.
Description check	✅ Passed	The description covers the changes, motivation, security advisories, remaining development-only dependency, checklist, and release impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.changeset/olive-experts-look.md:
- Line 5: Update the changeset claim and dependency configuration so the
`@rspack/dev-server` path no longer resolves shell-quote@1.8.3, using a compatible
override or dependency update to reach a version fixing both advisories. If the
change intentionally only covers `@tanstack/devtools-bundler-core`, revise the
changeset to state that scope and explicitly document the remaining development
dependency.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e78baf5c-12c2-472a-bb25-0a4a4d4c8ea1

📥 Commits

Reviewing files that changed from the base of the PR and between 353a635 and bcae55c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• .changeset/olive-experts-look.md
• packages/devtools-bundler-core/package.json