From 100078e1e2d944454ccc544718ee46987a20aa08 Mon Sep 17 00:00:00 2001 From: le king fu Date: Fri, 25 Sep 2026 20:10:07 -0400 Subject: [PATCH] fix(security): raise @xmldom/xmldom and js-yaml override floors Advisories published on 2026-09-08 land above the current floors: - @xmldom/xmldom <= 0.8.14 (GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4, GHSA-93r5-fhx6-vmg9 and 7 more), patched in 0.8.15 (lts line) - js-yaml < 3.15.2 / < 4.3.2 (GHSA-2883-xcg3-v3hh) Raise the three overrides. Lock diff is limited to the three entries. All consumers are build-time tooling (@expo/plist, plist via xcode, @expo/xcpretty, @istanbuljs/load-nyc-config); the Android bundle hash is unchanged. Fixes #121 Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 18 +++++++++--------- package.json | 6 +++--- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index 45f1979..5c6f869 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2713,9 +2713,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "license": "MIT", "dependencies": { "argparse": "^1.0.7", @@ -3797,9 +3797,9 @@ } }, "node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "license": "MIT", "engines": { "node": ">=10.0.0" @@ -7696,9 +7696,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 83619e6..0248fe1 100644 --- a/package.json +++ b/package.json @@ -68,11 +68,11 @@ }, "overrides": { "esbuild": "^0.25.0", - "@xmldom/xmldom": "^0.8.13", + "@xmldom/xmldom": "^0.8.15", "uuid": "^11.1.1", "postcss": "^8.5.18", - "js-yaml@^3.0.0": "^3.15.1", - "js-yaml@^4.0.0": "^4.3.1", + "js-yaml@^3.0.0": "^3.15.2", + "js-yaml@^4.0.0": "^4.3.2", "brace-expansion@^1.0.0": "^1.1.18", "brace-expansion@^2.0.0": "^2.1.4", "brace-expansion@^5.0.0": "^5.0.9",