diff --git a/.github/workflows/playground-dependencies.yml b/.github/workflows/playground-dependencies.yml
new file mode 100644
index 0000000..e9b5b7c
--- /dev/null
+++ b/.github/workflows/playground-dependencies.yml
@@ -0,0 +1,32 @@
+name: Playground dependency contracts
+on:
+  pull_request:
+    paths: ['playground/**', 'playground.nix', '.github/workflows/playground-dependencies.yml']
+  push:
+    branches: [main]
+    paths: ['playground/**', 'playground.nix', '.github/workflows/playground-dependencies.yml']
+permissions:
+  contents: read
+jobs:
+  contracts:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: playground
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: playground/package-lock.json
+      - run: npm ci
+      - run: npm run test:dependencies
+  production-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - run: nix-build -A packages.playground
diff --git a/playground.nix b/playground.nix
index d4f738a..b0ac5ca 100644
--- a/playground.nix
+++ b/playground.nix
@@ -11,7 +11,7 @@ pkgs.buildNpmPackage {
 
   src = ./playground;
 
-  npmDepsHash = "sha256-6nntf8nFU5i23anG1WPOvqTcUu7LHXV0lPOYxqEhkv8=";
+  npmDepsHash = "sha256-gSP3f9loTPkeYK3l0Q1d28QXhujErE19k92flsh7EzA=";
 
   nativeBuildInputs = [
     pkgs.wasm-bindgen-cli
diff --git a/playground/package-lock.json b/playground/package-lock.json
index 7026326..8ee5cb9 100644
--- a/playground/package-lock.json
+++ b/playground/package-lock.json
@@ -923,9 +923,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/playground/package.json b/playground/package.json
index e9345c9..1f659c2 100644
--- a/playground/package.json
+++ b/playground/package.json
@@ -5,7 +5,8 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "test:dependencies": "node --test tests/dependencies/*.test.mjs"
   },
   "dependencies": {
     "monaco-editor": "^0.52.0",
diff --git a/playground/tests/dependencies/picomatch.test.mjs b/playground/tests/dependencies/picomatch.test.mjs
new file mode 100644
index 0000000..1b0fea5
--- /dev/null
+++ b/playground/tests/dependencies/picomatch.test.mjs
@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import picomatch from 'picomatch';
+import { build } from 'vite';
+import { mkdtemp, writeFile, mkdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+test('Vite glob imports include supported source files and exclude tests', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'stlcpp-glob-'));
+  try {
+    await mkdir(join(root, 'examples'));
+    await writeFile(join(root, 'examples', 'lambda.js'), 'export default "lambda";');
+    await writeFile(join(root, 'examples', 'ignored.test.js'), 'export default "must-not-ship";');
+    await writeFile(join(root, 'entry.js'), 'export const examples = import.meta.glob(["./examples/*.js", "!./examples/*.test.js"], {eager:true});');
+    const result = await build({ root, configFile: false, logLevel: 'silent', build: {
+      write: false, minify: false, lib: { entry: join(root, 'entry.js'), formats: ['es'] },
+    } });
+    const code = result[0].output.find((item) => item.type === 'chunk').code;
+    assert.match(code, /lambda/);
+    assert.doesNotMatch(code, /must-not-ship/);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+test('glob matching handles nested paths, alternatives and literal punctuation', () => {
+  const match = picomatch('src/**/*.{js,css}', { ignore: '**/*.test.js' });
+  assert.equal(match('src/nested/editor.js'), true);
+  assert.equal(match('src/style.css'), true);
+  assert.equal(match('src/editor.test.js'), false);
+  assert.equal(match('outside/editor.js'), false);
+  assert.equal(picomatch('src/file\\[1\\].js')('src/file[1].js'), true);
+});