diff --git a/.changeset/deep-berries-feel.md b/.changeset/deep-berries-feel.md
new file mode 100644
index 00000000..c3490544
--- /dev/null
+++ b/.changeset/deep-berries-feel.md
@@ -0,0 +1,5 @@
+---
+"@rebilly/client-php": patch
+---
+
+chore(deps): bump picomatch
diff --git a/package-lock.json b/package-lock.json
index e14edf35..f1170051 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1795,9 +1795,9 @@
       }
     },
     "node_modules/micromatch/node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {