From bd7cbe1b567f037f64db8e2839ae700118a1db25 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 11:45:53 +0000 Subject: [PATCH 1/2] fix(deps): resolve high and critical dependabot alerts via overrides Bump pnpm overrides to patched releases: shell-quote 1.12.0 (critical), brace-expansion 1.1.21 / 5.0.12, compression 1.8.2, source-map-js 1.2.2, image-size 2.0.4. node-forge and braces have no patched release yet. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01D3Ba7ExS8d1j3xFXvJXNn1 --- package.json | 9 ++++--- pnpm-lock.yaml | 71 +++++++++++++++++++++++--------------------------- 2 files changed, 39 insertions(+), 41 deletions(-) diff --git a/package.json b/package.json index 20c3153..9100f70 100644 --- a/package.json +++ b/package.json @@ -20,14 +20,17 @@ "overrides": { "@xmldom/xmldom": "0.9.12", "baseline-browser-mapping": "2.11.23", - "brace-expansion@1": "1.1.18", - "brace-expansion@5": "5.0.9", + "brace-expansion@1": "1.1.21", + "brace-expansion@5": "5.0.12", "browserslist": "4.28.9", + "compression": "1.8.2", + "image-size@1": "2.0.4", "js-yaml@3": "3.15.2", "js-yaml@4": "4.3.2", "nanoid@3": "3.3.19", "postcss": "8.5.28", - "shell-quote": "1.10.0", + "shell-quote": "1.12.0", + "source-map-js": "1.2.2", "uuid@7": "11.1.1", "ws@7": "7.5.13", "ws@8": "8.21.3" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 18bddae..5fb62c4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,14 +7,17 @@ settings: overrides: '@xmldom/xmldom': 0.9.12 baseline-browser-mapping: 2.11.23 - brace-expansion@1: 1.1.18 - brace-expansion@5: 5.0.9 + brace-expansion@1: 1.1.21 + brace-expansion@5: 5.0.12 browserslist: 4.28.9 + compression: 1.8.2 + image-size@1: 2.0.4 js-yaml@3: 3.15.2 js-yaml@4: 4.3.2 nanoid@3: 3.3.19 postcss: 8.5.28 - shell-quote: 1.10.0 + shell-quote: 1.12.0 + source-map-js: 1.2.2 uuid@7: 11.1.1 ws@7: 7.5.13 ws@8: 8.21.3 @@ -1434,11 +1437,11 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -1550,8 +1553,8 @@ packages: resolution: {integrity: sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==} engines: {node: '>= 0.6'} - compression@1.8.1: - resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} + compression@1.8.2: + resolution: {integrity: sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==} engines: {node: '>= 0.8.0'} concat-map@0.0.1: @@ -1907,9 +1910,9 @@ packages: resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==} engines: {node: '>= 4'} - image-size@1.2.1: - resolution: {integrity: sha512-rH+46sQJ2dlwfjfhCyNx5thzrv+dtmBIhPHk0zgRUukHzZ/kRueTJXoYYsclBaKcSMBWuGbOFXtioLpzTb5euw==} - engines: {node: '>=16.x'} + image-size@2.0.4: + resolution: {integrity: sha512-QRUkFFsRV/6fuESxb9Vkq+a0LkSrgKXuc2NEqfikiXxxN/G3tjWt5EVUlMaImRBZRZK/jRBEbYvpPYZL8t08Zw==} + engines: {node: '>=18'} hasBin: true imurmurhash@0.1.4: @@ -2490,9 +2493,6 @@ packages: queue-microtask@1.2.3: resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==} - queue@6.0.2: - resolution: {integrity: sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==} - range-parser@1.2.1: resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==} engines: {node: '>= 0.6'} @@ -2657,8 +2657,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.10.0: - resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==} + shell-quote@1.12.0: + resolution: {integrity: sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==} engines: {node: '>= 0.4'} siginfo@2.0.0: @@ -2681,8 +2681,8 @@ packages: resolution: {integrity: sha512-h+z7HKHYXj6wJU+AnS/+IH8Uh9fdcX1Lrhg1/VMdf9PwoBQXFcXiAdsy2tSK0P6gKwJLXp02r90ahUCqHk9rrw==} engines: {node: '>=8.0.0'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map-support@0.5.21: @@ -3862,7 +3862,7 @@ snapshots: bplist-parser: 0.3.2 chalk: 4.1.2 ci-info: 3.9.0 - compression: 1.8.1 + compression: 1.8.2 connect: 3.7.0 debug: 4.4.3 dnssd-advertise: 1.1.4 @@ -4927,12 +4927,12 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.2 @@ -5049,11 +5049,12 @@ snapshots: dependencies: mime-db: 1.54.0 - compression@1.8.1: + compression@1.8.2: dependencies: bytes: 3.1.2 compressible: 2.0.18 debug: 2.6.9 + destroy: 1.2.0 negotiator: 0.6.4 on-headers: 1.1.0 safe-buffer: 5.2.1 @@ -5404,9 +5405,7 @@ snapshots: ignore@5.3.2: {} - image-size@1.2.1: - dependencies: - queue: 6.0.2 + image-size@2.0.4: {} imurmurhash@0.1.4: {} @@ -5663,7 +5662,7 @@ snapshots: dependencies: '@babel/parser': 7.29.7 '@babel/types': 7.29.7 - source-map-js: 1.2.1 + source-map-js: 1.2.2 make-dir@4.0.0: dependencies: @@ -5831,7 +5830,7 @@ snapshots: flow-enums-runtime: 0.0.6 graceful-fs: 4.2.11 hermes-parser: 0.32.0 - image-size: 1.2.1 + image-size: 2.0.4 invariant: 2.2.4 jest-worker: 29.7.0 jsc-safe-url: 0.2.4 @@ -5879,11 +5878,11 @@ snapshots: minimatch@10.2.3: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.4: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minipass@7.1.2: {} @@ -6023,7 +6022,7 @@ snapshots: dependencies: nanoid: 3.3.19 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 pretty-format@29.7.0: dependencies: @@ -6048,15 +6047,11 @@ snapshots: queue-microtask@1.2.3: {} - queue@6.0.2: - dependencies: - inherits: 2.0.4 - range-parser@1.2.1: {} react-devtools-core@6.1.5: dependencies: - shell-quote: 1.10.0 + shell-quote: 1.12.0 ws: 7.5.13 transitivePeerDependencies: - bufferutil @@ -6314,7 +6309,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.10.0: {} + shell-quote@1.12.0: {} siginfo@2.0.0: {} @@ -6332,7 +6327,7 @@ snapshots: slugify@1.6.6: {} - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.21: dependencies: From 988a44c9813fe9569881b178be9e4de903da0990 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 11:55:16 +0000 Subject: [PATCH 2/2] fix(deps): drop image-size override, incompatible with Metro 0.83.3 Metro's getAssetData passes a file path to image-size, which v2 rejects (Uint8Array only). image-size has no patched 1.x release, so those alerts stay open until Expo moves to a Metro that no longer depends on it. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01D3Ba7ExS8d1j3xFXvJXNn1 --- package.json | 1 - pnpm-lock.yaml | 20 ++++++++++++++------ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 9100f70..d013fb6 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,6 @@ "brace-expansion@5": "5.0.12", "browserslist": "4.28.9", "compression": "1.8.2", - "image-size@1": "2.0.4", "js-yaml@3": "3.15.2", "js-yaml@4": "4.3.2", "nanoid@3": "3.3.19", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5fb62c4..8689656 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,7 +11,6 @@ overrides: brace-expansion@5: 5.0.12 browserslist: 4.28.9 compression: 1.8.2 - image-size@1: 2.0.4 js-yaml@3: 3.15.2 js-yaml@4: 4.3.2 nanoid@3: 3.3.19 @@ -1910,9 +1909,9 @@ packages: resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==} engines: {node: '>= 4'} - image-size@2.0.4: - resolution: {integrity: sha512-QRUkFFsRV/6fuESxb9Vkq+a0LkSrgKXuc2NEqfikiXxxN/G3tjWt5EVUlMaImRBZRZK/jRBEbYvpPYZL8t08Zw==} - engines: {node: '>=18'} + image-size@1.2.1: + resolution: {integrity: sha512-rH+46sQJ2dlwfjfhCyNx5thzrv+dtmBIhPHk0zgRUukHzZ/kRueTJXoYYsclBaKcSMBWuGbOFXtioLpzTb5euw==} + engines: {node: '>=16.x'} hasBin: true imurmurhash@0.1.4: @@ -2493,6 +2492,9 @@ packages: queue-microtask@1.2.3: resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==} + queue@6.0.2: + resolution: {integrity: sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==} + range-parser@1.2.1: resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==} engines: {node: '>= 0.6'} @@ -5405,7 +5407,9 @@ snapshots: ignore@5.3.2: {} - image-size@2.0.4: {} + image-size@1.2.1: + dependencies: + queue: 6.0.2 imurmurhash@0.1.4: {} @@ -5830,7 +5834,7 @@ snapshots: flow-enums-runtime: 0.0.6 graceful-fs: 4.2.11 hermes-parser: 0.32.0 - image-size: 2.0.4 + image-size: 1.2.1 invariant: 2.2.4 jest-worker: 29.7.0 jsc-safe-url: 0.2.4 @@ -6047,6 +6051,10 @@ snapshots: queue-microtask@1.2.3: {} + queue@6.0.2: + dependencies: + inherits: 2.0.4 + range-parser@1.2.1: {} react-devtools-core@6.1.5: