[AndrewGable]

Explanation of Change

Resolve the example application's transitive minimatch dependency to ^3.1.5 and update its Yarn lockfile from 3.0.4 to 3.1.5. Existing consumers request ^3.0.4, so this preserves the current major version and CommonJS interface. Only the example manifest and minimatch lock entry change.

Version 3.1.5 falls outside the vulnerable ranges listed on all four open minimatch alerts. The existing Dependabot PR targets 3.1.2, which still falls within three of those ranges.

Review limitation: matching the advisory version ranges does not establish safety for arbitrary untrusted patterns. Direct tests on 3.1.5 still stalled on the nested extglob advisory example and on a pattern with separated repeated wildcards. Each process was stopped by a timeout. The upstream 3.1.5 security guidance explicitly warns about untrusted patterns. This draft records that limitation and does not claim complete ReDoS protection. A broader tooling or matching change needs a separate compatibility review.

Fixed Issues

For https://github.com/Expensify/Expensify/issues/701864

AI Tests

1. Installed the original lockfile with Yarn 1.22.22 on Node 20.20.2 before changing dependencies.
2. The existing Jest suite fails before and after the change with the same module resolution error: it cannot find react-native when loading the parent library's index.js. No tests execute. This existing harness problem is outside the dependency update.
3. Updated dependencies and ran a frozen lockfile installation successfully. yarn list confirms minimatch 3.1.5.
4. Temporary direct checks passed for ordinary matching, the consecutive wildcard advisory example, and the multiple globstar advisory example. A separate nested extglob check and a separated wildcard stress check timed out, as described above.
5. Compared 3.1.5 against all four open advisory ranges and confirmed it is outside each range.
6. Reviewed the focused diff, passed git diff --check, and verified the committed version and ordinary matching after committing. No new test files or infrastructure were added.

Tests

1. In example, install using yarn install with the frozen lockfile option on Node 20.
2. Run yarn list with the minimatch pattern and confirm 3.1.5 is installed.
3. Run the existing Jest test and compare its React Native resolution failure with the base branch.

QA

Keep this PR in draft pending review of the residual pattern risk and existing Jest harness failure. No native application code changed.

PR Author Checklist

1. Complete: linked the issue, reviewed the four alerts, and limited the dependency change to the example.
2. Complete: verified installation, version ranges, direct matching, and the existing test failure on both versions.
3. Pending: human review of the residual ReDoS limitation before marking ready.