Apply Dependabot updates and fix bundler-audit failure on main

[PaulgSmith]

Rolls up the open Dependabot PRs that are actually installable together, and fixes the security scan that is currently failing on main.

Why main is red today

bin/bundler-audit fails on sqlite3 2.9.5 — GHSA-mwm8-39rw-8826, a use-after-free in SQLite aggregate arguments. The sqlite3 bump below clears it, which turns the scan_ruby job green again.

Applied — 8 of the 12 open Dependabot PRs

Bundler (all 5):

gem	from	to
brakeman	8.0.5	8.0.6
image_processing	2.0.2	2.0.3
selenium-webdriver	4.46.0	4.47.0 (pulls rubyzip 3.5.0)
sqlite3	2.9.5	2.9.6 (security)
thruster	0.1.23	0.1.25

npm / mobile:

package	from	to
@rn-primitives/portal	1.5.2	1.5.3
lucide-react-native	1.28.0	1.33.0
jest-expo	57.0.3	57.0.4
@expo/ui	57.0.8	57.0.11
expo	57.0.9	57.0.14
expo-image	57.0.1	57.0.3
expo-linking	57.0.4	57.0.6
expo-router	57.0.9	57.0.13
expo-splash-screen	57.0.5	57.0.6
react-native-gesture-handler	3.1.0	3.2.1
react-native-safe-area-context	5.8.0	5.9.0
react-native-screens	4.26.0	4.27.0
react-native-svg	15.15.4	15.15.5

Held back — 4 PRs that cannot merge as proposed

Each of these was reproduced as a hard failure, not skipped out of caution. They should be closed rather than rebased, since retrying produces the same result.

react-native 0.86.2 → 0.87.0 (part of the expo group PR)
Expo SDK 57 pins react-native 0.86.2, and the newest published react-native-reanimated (4.5.3) peers react-native: "0.83 - 0.86". No reanimated release supports 0.87 yet, so the group PR's own lockfile is peer-invalid — a plain npm install of those versions is rejected by npm outright.

react-native-worklets 0.10.3 → 0.11.4 (same PR)
expo-modules-core peers worklets at "^0.7.4 || ^0.8.0 || ^0.9.0 || ^0.10.0". 0.11.4 falls outside that, so npm stops hoisting expo-modules-core and nests it under node_modules/expo/. jest-expo's preset resolves it from the tree root, so the entire mobile suite dies with Cannot find module 'expo-modules-core'.

eslint 9.39.5 → 10.8.1
eslint-config-expo vendors eslint-plugin-react 7.37.5, which calls context.getFilename() — removed in ESLint 10. npm run lint crashes with TypeError: contextOrFilename.getFilename is not a function. 7.37.5 is the latest release and peers eslint: "^3 || … || ^9.7", so there is no version to override to. Blocked until eslint-plugin-react ships ESLint 10 support.

jest 29.7.0 → 30.4.2 (+ @types/jest 30)
jest-expo 57.0.4 depends on jest 29 internals (babel-jest, @jest/globals, jest-snapshot, jest-environment-jsdom, all ^29.2.1). Mixing in jest 30 gives TypeError: this._moduleMocker.clearMocksOnScope is not a function from jest-runtime. Needs a jest-30 release of jest-expo.

tailwindcss 3.4.19 → 4.3.3
nativewind 4.2.6 depends on react-native-css-interop, which peers tailwindcss: "~3". Under v4 npm nests it and every component test fails on Cannot find module 'react-native-css-interop'. The Tailwind v4 line is nativewind@5.0.0-preview.4 — a migration, not a version bump.

⚠️ Worth knowing: CI would not have caught the Tailwind break on its own. jest.config.js maps \.css$ to a stub, so Tailwind is never exercised by the test suite — it only compiles during a real Metro bundle. A tailwind v4 PR could have gone green in CI and broken the app. That's why this branch was additionally verified with expo export.

One deliberate change beyond the bumps

npm install rewrote the exact pins on react-native-worklets and react-native-svg into caret ranges. I restored both to exact pins — ^0.10.3 on worklets would let a later resolve pull 0.11.x and silently reintroduce the hoisting failure described above.

Verification

Every CI job was run locally against this exact tree (Node 22, Ruby 4.0.5):

check	result
bin/brakeman --no-pager	no warnings
bin/bundler-audit	no vulnerabilities
bin/importmap audit	no vulnerable packages
bin/rubocop	32 files, no offenses
bin/rails db:test:prepare test	20 runs, 60 assertions, 0 failures
bin/rails db:test:prepare test:system	0 runs (none defined)
mobile: npm ci	clean
mobile: npm run lint	clean
mobile: npm run typecheck	clean
mobile: npm test	4 suites, 28 tests passed
mobile: expo export --platform web	bundles; NativeWind emits its 23KB stylesheet

npm audit --audit-level=high still reports the pre-existing Expo toolchain advisories, unchanged by this PR — that step is already continue-on-error in ci.yml.

🤖 Generated with Claude Code