Repository navigation
fix(deps): override vulnerable transitive dependencies - #13
Merged
Merged
Conversation
Dependabot alerts: lift body-parser, fast-uri, qs, undici and uuid to the first fixed version in the same major line. node-forge is fixed in #10. Dependabot must not open updates that break the Expo SDK pins: jest-expo and @react-native/* follow the SDK, React stays at the pinned version, and @types/node stays at the Node.js version of CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm-workspace.yamlfor the Dependabot alerts that have a fix in the same major line:body-parser2.4.0,fast-uri3.1.9,qs6.17.1,undici6.29.1 and 8.12.3,uuid11.1.1. Each selector changes only the vulnerable versions.uuidgoes from 7 to 11. Its only user isxcode(Expo config plugins), which calls onlyuuid.v4(). uuid 11 keeps this in CommonJS.npx expo config --type prebuildworks..github/dependabot.yml: Dependabot does not open these updates again, because they break the Expo SDK 57 / React Native 0.86 pins:jest-expomajor (build(deps-dev): Bump jest-expo from 57.0.6 to 58.0.11 #8 is jest-expo 58)@react-native/*minor (build(deps-dev): Bump the dev-dependencies group across 1 directory with 12 updates #12 has@react-native/jest-preset0.88)react,react-dom,@types/react,@types/react-domminor andreact-native-safe-area-contextminor (build(deps): Bump the dependencies group across 1 directory with 7 updates #11 has React 19.3.1 and safe-area-context 5.11;pnpm-workspace.yamlpins React 19.2.3)@types/nodemajor (build(deps-dev): Bump @types/node from 24.19.2 to 26.6.5 #7 is @types/node 26; CI uses Node.js 24)Alerts that stay open (no fix in the same major line)
zod3.25.76 andglob13: from@expo/cli. The fix is only in zod 4 / glob 14. The latest@expo/cli57 still uses zod 3 and glob 13.glob7/8/10 andminimatch3/5/9/10: from Jest, Detox and ESLint. The fixes are only in glob 14 and minimatch 11.stream-json1.9.1: from Detox. The fix is only in stream-json 3.deepmerge4.3.1: no fixed version.All of these are development tools (Expo CLI, Jest, Detox, ESLint). They are not in the app bundle or the server runtime.
Test plan
pnpm verifynpx expo config --type prebuildinapps/mobile🤖 Generated with Claude Code