Thanks @smcdougall, see https://github.com/picocms/Pico/commit/ee5b4f0d56fb565aac4ef50e8cd6d0dd8ae45084#commitcomment-17304977
@@ -6,7 +6,7 @@
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?$1 [L,QSA]
RewriteRule ^(\.git|config|content|content-sample|lib|vendor)(/.*)?$ index.php?$0 [L,QSA]
- RewriteRule ^(CHANGELOG.md|composer.(json|lock)) index.php?404 [L]
+ RewriteRule ^(CHANGELOG\.md|composer\.(json|lock)) index.php?404 [L]
<IfModule mod_env.c>
SetEnv PICO_URL_REWRITING 1