From c40dc434d9e633c5121c191f726fe0f63765260d Mon Sep 17 00:00:00 2001 From: Alican Kilicarslan <29822821+akilicarslan@users.noreply.github.com> Date: Tue, 3 Nov 2026 10:06:36 -0600 Subject: [PATCH] fix(deps): override vulnerable transitive dependencies Dependabot alerts: lift body-parser, fast-uri, qs, undici and uuid to the first fixed version in the same major line. node-forge is fixed in #10. Dependabot must not open updates that break the Expo SDK pins: jest-expo and @react-native/* follow the SDK, React stays at the pinned version, and @types/node stays at the Node.js version of CI. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 18 ++++++++++++- pnpm-lock.yaml | 59 +++++++++++++++++++++++------------------- pnpm-workspace.yaml | 10 +++++++ 3 files changed, 59 insertions(+), 28 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 22e9c6d..fa8187a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,11 +19,27 @@ updates: update-types: ['version-update:semver-major'] - dependency-name: 'expo-*' update-types: ['version-update:semver-major'] + - dependency-name: 'jest-expo' + update-types: ['version-update:semver-major'] - dependency-name: 'react-native' update-types: ['version-update:semver-major', 'version-update:semver-minor'] + # These packages have the same version as React Native. + - dependency-name: '@react-native/*' + update-types: ['version-update:semver-major', 'version-update:semver-minor'] + # The Expo SDK sets these versions. Use `npx expo install --fix` in apps/mobile. + - dependency-name: 'react-native-safe-area-context' + update-types: ['version-update:semver-major', 'version-update:semver-minor'] + # pnpm-workspace.yaml pins one React version for the Expo SDK. - dependency-name: 'react' - update-types: ['version-update:semver-major'] + update-types: ['version-update:semver-major', 'version-update:semver-minor'] - dependency-name: 'react-dom' + update-types: ['version-update:semver-major', 'version-update:semver-minor'] + - dependency-name: '@types/react' + update-types: ['version-update:semver-major', 'version-update:semver-minor'] + - dependency-name: '@types/react-dom' + update-types: ['version-update:semver-major', 'version-update:semver-minor'] + # CI and the engines field use Node.js 24. Update the types with Node.js. + - dependency-name: '@types/node' update-types: ['version-update:semver-major'] - package-ecosystem: github-actions diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4782ecb..f6e11f2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -166,6 +166,12 @@ overrides: react: 19.2.3 react-dom: 19.2.3 react-native: 0.86.3 + body-parser@>=2 <2.4.0: ^2.4.0 + fast-uri@>=3 <3.1.9: ^3.1.9 + qs@>=6.7.0 <6.16.1: ^6.16.1 + undici@>=6 <6.29.1: ^6.29.1 + undici@>=8 <8.12.2: ^8.12.2 + uuid@<11.1.1: ^11.1.1 importers: @@ -3140,8 +3146,8 @@ packages: bluebird@3.7.2: resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} bplist-creator@0.1.0: @@ -3975,8 +3981,8 @@ packages: fast-safe-stringify@2.1.1: resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==} - fast-uri@3.1.8: - resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fastq@1.20.3: resolution: {integrity: sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==} @@ -5502,8 +5508,8 @@ packages: resolution: {integrity: sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==} engines: {node: '>=20'} - qs@6.16.0: - resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} + qs@6.17.1: + resolution: {integrity: sha512-jd3COkaKVgGUW+ZHyEHCG9bH7RoaaiWuMgzsIBjUMVjLAaWGWpoUAVwljVvBHxRu/2qEHnadLGZrkutYUBPQJA==} engines: {node: '>=0.6'} querystringify@2.2.0: @@ -6256,12 +6262,12 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@6.29.0: - resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==} + undici@6.29.1: + resolution: {integrity: sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==} engines: {node: '>=18.17'} - undici@8.11.2: - resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} + undici@8.12.3: + resolution: {integrity: sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==} engines: {node: '>=22.19.0'} unicode-canonical-property-names-ecmascript@2.0.1: @@ -6326,9 +6332,8 @@ packages: resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==} engines: {node: '>= 0.4.0'} - uuid@7.0.3: - resolution: {integrity: sha512-DPSke0pXhTZgoF/d+WSt2QaKMCFSfx7QegxEWT+JOuHF5aWrKEn0G+ztjuJg/gG8/ItK+rbPCD/yNv8yyih6Cg==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} hasBin: true v8-compile-cache-lib@3.0.1: @@ -6681,7 +6686,7 @@ snapshots: dependencies: '@types/json-schema': 7.0.15 js-yaml: 5.4.3 - undici: 6.29.0 + undici: 6.29.1 '@asamuzakjp/css-color@7.1.5': dependencies: @@ -9442,7 +9447,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.8 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -9747,7 +9752,7 @@ snapshots: bluebird@3.7.2: {} - body-parser@2.3.0(supports-color@8.1.1): + body-parser@2.4.0(supports-color@8.1.1): dependencies: bytes: 3.1.2 content-type: 2.1.0 @@ -9755,7 +9760,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.16.0 + qs: 6.17.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -10649,7 +10654,7 @@ snapshots: express@5.3.0(supports-color@8.1.1): dependencies: accepts: 2.0.0 - body-parser: 2.3.0(supports-color@8.1.1) + body-parser: 2.4.0(supports-color@8.1.1) content-disposition: 2.0.1 content-type: 2.1.0 cookie: 0.7.2 @@ -10668,7 +10673,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.8 - qs: 6.16.0 + qs: 6.17.1 range-parser: 1.3.0 router: 2.2.0(supports-color@8.1.1) send: 1.2.1(supports-color@8.1.1) @@ -10695,7 +10700,7 @@ snapshots: fast-safe-stringify@2.1.1: {} - fast-uri@3.1.8: {} + fast-uri@3.1.9: {} fastq@1.20.3: dependencies: @@ -11749,7 +11754,7 @@ snapshots: parse5: 8.0.1 saxes: 6.0.0 tough-cookie: 6.0.2 - undici: 8.11.2 + undici: 8.12.3 w3c-xmlserializer: 6.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -12713,7 +12718,7 @@ snapshots: dependencies: hookified: 2.2.0 - qs@6.16.0: + qs@6.17.1: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -13364,7 +13369,7 @@ snapshots: formidable: 3.5.4 methods: 1.1.2 mime: 2.6.0 - qs: 6.16.0 + qs: 6.17.1 transitivePeerDependencies: - supports-color @@ -13597,9 +13602,9 @@ snapshots: undici-types@7.24.6: {} - undici@6.29.0: {} + undici@6.29.1: {} - undici@8.11.2: {} + undici@8.12.3: {} unicode-canonical-property-names-ecmascript@2.0.1: {} @@ -13677,7 +13682,7 @@ snapshots: utils-merge@1.0.1: {} - uuid@7.0.3: {} + uuid@11.1.1: {} v8-compile-cache-lib@3.0.1: optional: true @@ -13899,7 +13904,7 @@ snapshots: xcode@3.0.1: dependencies: simple-plist: 1.3.1 - uuid: 7.0.3 + uuid: 11.1.1 xml-name-validator@4.0.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3204091..deb7fff 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -13,6 +13,16 @@ overrides: react: 19.2.3 react-dom: 19.2.3 react-native: 0.86.3 + # Security fixes for transitive dependencies (Dependabot alerts). + # Each selector lifts only the vulnerable versions, in the same major line. + # Remove an entry when its parent package depends on the fixed version. + body-parser@>=2 <2.4.0: ^2.4.0 + fast-uri@>=3 <3.1.9: ^3.1.9 + qs@>=6.7.0 <6.16.1: ^6.16.1 + undici@>=6 <6.29.1: ^6.29.1 + undici@>=8 <8.12.2: ^8.12.2 + # xcode (Expo config plugins) calls only uuid.v4(), which uuid 11 keeps in CommonJS. + uuid@<11.1.1: ^11.1.1 # pnpm blocks dependency build scripts by default. Allow only what we need. allowBuilds: