From 0e4c5cdb4eae26fefaefcb120397d7f9750d4daf Mon Sep 17 00:00:00 2001 From: le king fu Date: Tue, 11 Aug 2026 20:47:23 -0400 Subject: [PATCH] fix(security): bump undici + js-yaml overrides to patched versions - @expo/cli > undici ^6.27.0 -> ^6.28.0: GHSA-8xcm-r25x-g524 / m8rv-5g2x-5cg5 / v3r7-h72x-cjcm (response desync, CRLF & cookie injection; vulnerable <6.28.0) - js-yaml -> ^3.15.1 (3.x) + ^4.3.1 (4.x): CVE-2026-59870 / GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap resolution; vulnerable 3.x<3.15.1, 4.x<4.3.1) js-yaml moved from parent-scoped overrides (@expo/xcpretty, @istanbuljs/load-nyc-config) to version-scoped ones (js-yaml@^3 / js-yaml@^4): the 4.x instance is reached via @expo/cli, which is itself overridden, and a nested override does not propagate through an overridden parent (npm left js-yaml@4.3.0 "invalid"). Version-scoped targeting resolves it regardless of the parent path. Both build/dev-time only, not bundled in the shipped APK. npm audit drops undici + js-yaml (16 -> 14). Remaining 13 high = image-size + its metro/RN cascade (upstream-locked, tracked in #108) + @babel/core low. Smoke test green, widget patch reapplied, lock diff limited to the 3 bumped packages. Fixes #106 Fixes #107 Co-Authored-By: Claude Opus 4.8 --- package-lock.json | 68 +++++++++++++++++++++++------------------------ package.json | 10 +++---- 2 files changed, 37 insertions(+), 41 deletions(-) diff --git a/package-lock.json b/package-lock.json index e7cb4e6..a95b9cb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2679,34 +2679,6 @@ "excpretty": "build/cli.js" } }, - "node_modules/@expo/xcpretty/node_modules/argparse": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", - "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", - "license": "Python-2.0" - }, - "node_modules/@expo/xcpretty/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/@ide/backoff": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/@ide/backoff/-/backoff-1.0.0.tgz", @@ -2760,9 +2732,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.15.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", - "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "license": "MIT", "dependencies": { "argparse": "^1.0.7", @@ -7745,6 +7717,34 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==", "license": "MIT" }, + "node_modules/js-yaml": { + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, + "node_modules/js-yaml/node_modules/argparse": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", + "license": "Python-2.0" + }, "node_modules/jsc-safe-url": { "version": "0.2.4", "resolved": "https://registry.npmjs.org/jsc-safe-url/-/jsc-safe-url-0.2.4.tgz", @@ -11907,9 +11907,9 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", "license": "MIT", "engines": { "node": ">=18.17" diff --git a/package.json b/package.json index 6108503..150f21f 100644 --- a/package.json +++ b/package.json @@ -71,9 +71,11 @@ "@xmldom/xmldom": "^0.8.13", "uuid": "^11.1.1", "postcss": "^8.5.18", + "js-yaml@^3.0.0": "^3.15.1", + "js-yaml@^4.0.0": "^4.3.1", "@expo/cli": { "ws": "^8.20.1", - "undici": "^6.27.0", + "undici": "^6.28.0", "tar": "^7.5.21" }, "react-devtools-core": { @@ -88,12 +90,6 @@ }, "metro": { "ws": "^7.5.11" - }, - "@expo/xcpretty": { - "js-yaml": "^4.2.0" - }, - "@istanbuljs/load-nyc-config": { - "js-yaml": "^3.15.0" } }, "private": true