From 9eaa103a8751f98e2f2881175c75724993fdb1a7 Mon Sep 17 00:00:00 2001
From: le king fu <lekingfu@protonmail.com>
Date: Mon, 10 Aug 2026 08:28:47 -0400
Subject: [PATCH] fix(security): bump postcss + @expo/cli tar overrides to
 patched versions

- postcss ^8.5.10 -> ^8.5.18 (resolves to 8.5.26): GHSA-r28c-9q8g-f849,
  path traversal in source-map auto-loading (vulnerable <=8.5.17)
- @expo/cli > tar ^7.5.19 -> ^7.5.21 (resolves to 7.5.22): GHSA-r292-9mhp-454m,
  uncontrolled recursion stack-overflow DoS (vulnerable <=7.5.20)
- nanoid 3.3.11 -> 3.3.18 pulled in by postcss re-resolution (bonus)

Both are build/dev-time only, not bundled in the shipped APK. npm audit no
longer lists postcss (nor its transitive inflation expo/@expo/cli/
@expo/metro-config) nor tar. Smoke test green (11/11), widget patch-package
reapplied, diff limited to package.json + package-lock.json.

Fixes #102
Fixes #104

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 package-lock.json | 20 ++++++++++----------
 package.json      |  4 ++--
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 9af07f0..e7cb4e6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8844,9 +8844,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "funding": [
         {
           "type": "github",
@@ -9519,9 +9519,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.12",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
-      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -9538,7 +9538,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -11591,9 +11591,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.19",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz",
-      "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
diff --git a/package.json b/package.json
index a342736..6108503 100644
--- a/package.json
+++ b/package.json
@@ -70,11 +70,11 @@
     "esbuild": "^0.25.0",
     "@xmldom/xmldom": "^0.8.13",
     "uuid": "^11.1.1",
-    "postcss": "^8.5.10",
+    "postcss": "^8.5.18",
     "@expo/cli": {
       "ws": "^8.20.1",
       "undici": "^6.27.0",
-      "tar": "^7.5.19"
+      "tar": "^7.5.21"
     },
     "react-devtools-core": {
       "shell-quote": "^1.8.4",