From 8ac78aba8c55091e4c444bceac656b349daf6b83 Mon Sep 17 00:00:00 2001 From: Mark Murray Date: Tue, 1 Sep 2026 16:15:11 +0100 Subject: [PATCH] chore(react-native): patch vulnerable transitive dependencies --- platforms/react-native/package.json | 13 ++- platforms/react-native/pnpm-lock.yaml | 129 +++++++++++++++----------- 2 files changed, 86 insertions(+), 56 deletions(-) diff --git a/platforms/react-native/package.json b/platforms/react-native/package.json index 7cefc87e6..8aa419cfd 100644 --- a/platforms/react-native/package.json +++ b/platforms/react-native/package.json @@ -16,14 +16,21 @@ "unrs-resolver" ], "overrides": { - "shell-quote": ">=1.8.4", + "shell-quote": "1.9.0", "qs": ">=6.15.2", "flatted": ">=3.4.2", "minimatch@9": ">=9.0.7", "glob@10": ">=10.5.0", "picomatch": ">=4.0.4", - "js-yaml@3": ">=3.14.2", - "js-yaml@4": ">=4.2.0", + "js-yaml@3": "3.14.2", + "js-yaml@4": "4.3.1", + "brace-expansion@1": "1.1.16", + "brace-expansion@2": "2.1.4", + "brace-expansion@5": "5.0.7", + "fast-uri@3": "3.1.5", + "nanoid@3": "3.3.18", + "ws@6": "6.2.4", + "ws@7": "7.5.11", "@babel/core": ">=7.29.6", "@babel/plugin-transform-modules-systemjs": ">=7.29.4", "lodash": ">=4.18.0", diff --git a/platforms/react-native/pnpm-lock.yaml b/platforms/react-native/pnpm-lock.yaml index 64b338c09..aabd8cd5c 100644 --- a/platforms/react-native/pnpm-lock.yaml +++ b/platforms/react-native/pnpm-lock.yaml @@ -5,14 +5,21 @@ settings: excludeLinksFromLockfile: false overrides: - shell-quote: '>=1.8.4' + shell-quote: 1.9.0 qs: '>=6.15.2' flatted: '>=3.4.2' minimatch@9: '>=9.0.7' glob@10: '>=10.5.0' picomatch: '>=4.0.4' - js-yaml@3: '>=3.14.2' - js-yaml@4: '>=4.2.0' + js-yaml@3: 3.14.2 + js-yaml@4: 4.3.1 + brace-expansion@1: 1.1.16 + brace-expansion@2: 2.1.4 + brace-expansion@5: 5.0.7 + fast-uri@3: 3.1.5 + nanoid@3: 3.3.18 + ws@6: 6.2.4 + ws@7: 7.5.11 '@babel/core': '>=7.29.6' '@babel/plugin-transform-modules-systemjs': '>=7.29.4' lodash: '>=4.18.0' @@ -1965,7 +1972,7 @@ packages: engines: {node: '>=4'} async-limiter@1.0.1: - resolution: {integrity: sha512-csOlWGAcRFJaI6m+F2WKdnMKr4HhdhFVBk0H/QbJFMCr+uO2kwohwXQPxw/9OCxp05r5ghVBFSyioixx3gfkNQ==} + resolution: {integrity: sha512-csOlWGAcRFJaI6m+F2WKdnMKr4HhdhFVBk0H/QbJFMCr+uO2kwohwXQPxw/9OCxp05r5ghVBFSyioixx3gfkNQ==, tarball: https://registry.npmjs.org/async-limiter/-/async-limiter-1.0.1.tgz} asynciterator.prototype@1.0.0: resolution: {integrity: sha512-wwHYEIS0Q80f5mosx3L/dfG5t5rjEa9Ft51GTaNt862EnpyGHpgz2RkZvLPp1oF5TnAiTohkEKVEu8pQPJI7Vg==} @@ -2047,7 +2054,7 @@ packages: resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==, tarball: https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz} balanced-match@4.0.4: - resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} + resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==, tarball: https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz} engines: {node: 18 || 20 || >=22} base64-js@1.5.1: @@ -2065,14 +2072,14 @@ packages: resolution: {integrity: sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==, tarball: https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz} engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16} - brace-expansion@1.1.11: - resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==, tarball: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz} - brace-expansion@2.1.1: - resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==, tarball: https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==, tarball: https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==, tarball: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -2260,7 +2267,7 @@ packages: engines: {node: '>= 0.8.0'} concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} + resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==, tarball: https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz} connect@3.7.0: resolution: {integrity: sha512-ZqRXc+tZukToSNmh5C2iWMSoV3X1YUcPbqEM4DkEG5tNQXrQUZCNVGGv3IuicnkMtPfGf3Xtp8WCXs295iQ1pQ==, tarball: https://registry.npmjs.org/connect/-/connect-3.7.0.tgz} @@ -2597,6 +2604,11 @@ packages: resolution: {integrity: sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} + esprima@4.0.1: + resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==, tarball: https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz} + engines: {node: '>=4'} + hasBin: true + esquery@1.5.0: resolution: {integrity: sha512-YQLXUplAwJgCydQ78IMJywZCceoqk1oH01OERdSAJc/7U2AylwjhSCLDEtqwg811idIS/9fIU5GjG73IgjKMVg==} engines: {node: '>=0.10'} @@ -2668,8 +2680,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==, tarball: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz} fast-xml-builder@1.2.0: resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==, tarball: https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz} @@ -3381,8 +3393,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==, tarball: https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz} - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==, tarball: https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz} + js-yaml@3.14.2: + resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==, tarball: https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz} + hasBin: true + + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==, tarball: https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz} hasBin: true jsc-safe-url@0.2.4: @@ -3672,8 +3688,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==, tarball: https://registry.npmjs.org/ms/-/ms-2.1.3.tgz} - nanoid@3.3.11: - resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==, tarball: https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -4302,8 +4318,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==, tarball: https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz} engines: {node: '>=8'} - shell-quote@1.8.4: - resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==, tarball: https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz} + shell-quote@1.9.0: + resolution: {integrity: sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==, tarball: https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz} engines: {node: '>= 0.4'} side-channel-list@1.0.0: @@ -4741,8 +4757,8 @@ packages: resolution: {integrity: sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==} engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0} - ws@6.2.3: - resolution: {integrity: sha512-jmTjYU0j60B+vHey6TfR3Z7RD61z/hmxBS3VMSGIrroOWXQEneK1zNuotOUrGyBHQj0yrpsLHPWtigEFd13ndA==} + ws@6.2.4: + resolution: {integrity: sha512-PNIUUyLI5YpkJZj60YBzX1o0ByQ4ovvfmq9N/Kig/PAYbVlGyz4R6G0SEWrD0O9acc0sT2+IdMBVLFv8FSi0Nw==, tarball: https://registry.npmjs.org/ws/-/ws-6.2.4.tgz} peerDependencies: bufferutil: ^4.0.1 utf-8-validate: ^5.0.2 @@ -4752,8 +4768,8 @@ packages: utf-8-validate: optional: true - ws@7.5.10: - resolution: {integrity: sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==} + ws@7.5.11: + resolution: {integrity: sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==, tarball: https://registry.npmjs.org/ws/-/ws-7.5.11.tgz} engines: {node: '>=8.3.0'} peerDependencies: bufferutil: ^4.0.1 @@ -5843,7 +5859,7 @@ snapshots: globals: 13.23.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.1 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -5880,7 +5896,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 4.2.0 + js-yaml: 3.14.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.3': {} @@ -6298,7 +6314,7 @@ snapshots: open: 6.4.0 pretty-format: 26.6.2 serve-static: 1.16.2 - ws: 6.2.3 + ws: 6.2.4 transitivePeerDependencies: - bufferutil - supports-color @@ -6449,7 +6465,7 @@ snapshots: nullthrows: 1.1.1 open: 7.4.2 serve-static: 1.16.2 - ws: 6.2.3 + ws: 6.2.4 transitivePeerDependencies: - bufferutil - supports-color @@ -6534,7 +6550,7 @@ snapshots: '@react-navigation/routers': 7.5.3 escape-string-regexp: 4.0.0 fast-deep-equal: 3.1.3 - nanoid: 3.3.11 + nanoid: 3.3.18 query-string: 7.1.3 react: 19.1.0 react-is: 19.1.1 @@ -6572,14 +6588,14 @@ snapshots: '@react-navigation/core': 7.17.2(react@19.1.0) escape-string-regexp: 4.0.0 fast-deep-equal: 3.1.3 - nanoid: 3.3.11 + nanoid: 3.3.18 react: 19.1.0 react-native: 0.80.2(@babel/core@7.29.7)(@react-native-community/cli@19.1.2(typescript@5.9.2))(@types/react@19.1.12)(react@19.1.0) use-latest-callback: 0.2.6(react@19.1.0) '@react-navigation/routers@7.5.3': dependencies: - nanoid: 3.3.11 + nanoid: 3.3.18 '@react-navigation/stack@7.8.10(9fb8a0743704d8abe348a820053badd7)': dependencies: @@ -7017,7 +7033,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -7286,16 +7302,16 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@1.1.11: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.1: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.6: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -7515,7 +7531,7 @@ snapshots: dependencies: import-fresh: 2.0.0 is-directory: 0.3.1 - js-yaml: 4.2.0 + js-yaml: 3.14.2 parse-json: 4.0.0 cosmiconfig@7.1.0: @@ -7530,7 +7546,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.1 parse-json: 5.2.0 optionalDependencies: typescript: 5.9.2 @@ -7867,7 +7883,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 is-path-inside: 3.0.3 - js-yaml: 4.2.0 + js-yaml: 4.3.1 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -7885,6 +7901,8 @@ snapshots: acorn-jsx: 5.3.2(acorn@8.11.2) eslint-visitor-keys: 3.4.3 + esprima@4.0.1: {} + esquery@1.5.0: dependencies: estraverse: 5.3.0 @@ -7966,7 +7984,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.2: {} + fast-uri@3.1.5: {} fast-xml-builder@1.2.0: dependencies: @@ -8925,7 +8943,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.2.0: + js-yaml@3.14.2: + dependencies: + argparse: 1.0.10 + esprima: 4.0.1 + + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -8977,7 +9000,7 @@ snapshots: launch-editor@2.14.1: dependencies: picocolors: 1.1.1 - shell-quote: 1.8.4 + shell-quote: 1.9.0 leven@3.1.0: {} @@ -9231,7 +9254,7 @@ snapshots: serialize-error: 2.1.0 source-map: 0.5.7 throat: 5.0.0 - ws: 7.5.10 + ws: 7.5.11 yargs: 17.7.2 transitivePeerDependencies: - bufferutil @@ -9261,19 +9284,19 @@ snapshots: minimatch@10.2.3: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.7 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.11 + brace-expansion: 1.1.16 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.1 + brace-expansion: 2.1.4 minimatch@8.0.7: dependencies: - brace-expansion: 2.1.1 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -9289,7 +9312,7 @@ snapshots: ms@2.1.3: {} - nanoid@3.3.11: {} + nanoid@3.3.18: {} napi-postinstall@0.2.5: {} @@ -9579,8 +9602,8 @@ snapshots: react-devtools-core@6.1.5: dependencies: - shell-quote: 1.8.4 - ws: 7.5.10 + shell-quote: 1.9.0 + ws: 7.5.11 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -9756,7 +9779,7 @@ snapshots: semver: 7.7.2 stacktrace-parser: 0.1.10 whatwg-fetch: 3.6.19 - ws: 6.2.3 + ws: 6.2.4 yargs: 17.7.2 optionalDependencies: '@types/react': 19.1.12 @@ -9969,7 +9992,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.4: {} + shell-quote@1.9.0: {} side-channel-list@1.0.0: dependencies: @@ -10435,11 +10458,11 @@ snapshots: imurmurhash: 0.1.4 signal-exit: 4.1.0 - ws@6.2.3: + ws@6.2.4: dependencies: async-limiter: 1.0.1 - ws@7.5.10: {} + ws@7.5.11: {} xml-naming@0.1.0: {}