state: sync after #133, #134, #135 (PR #138)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -40,3 +40,9 @@ yarn-error.*
 # generated native folders
 /ios
 /android
+
+# Next.js build output (web companion)
+/.next/
+
+# autopilot daily reports
+/reports/

STATE.md

@@ -1,21 +1,26 @@
 # STATE — simpl-liste
 
-> Derniere MAJ : 2026-09-25 (par fix-issue #117)
+> Derniere MAJ : 2026-10-06 (par fix-issue #133, #134, #135 — PR #138)
 
 ## Position actuelle
 
-Version 1.6.6 (versionCode 18). Remediation securite en continu via overrides.
-Apres #117 (PR #119, 2026-09-25), `npm audit` = 6 findings : **2 HIGH** (`@xmldom/xmldom`
-<=0.8.14 et `js-yaml` 3.15.1 / 4.3.1, advisories publiees apres les planchers poses
-en avril/septembre — pas encore d'issue), 3 moderate (chaine `expo-router` ->
-`query-string@7` -> `decode-uri-component`, #120 bloquee sur un bump de SDK), 1 low
-(`postcss-selector-parser`).
+Version 1.6.6 (versionCode 18). `npm audit` = 40 entrees (0 critical) au 2026-10-06 apres
+PR #138, pour 5 advisories sans correctif publie (le reste est de la cascade de parents) :
+`braces` (high, #130), `node-forge` (high, #123), `postcss-selector-parser` GHSA-rj75
+(moderate, #136, sortie = tailwind 4), `sprintf-js` (moderate, #137) et la chaine
+`expo-router` -> `query-string@7` -> `decode-uri-component` (risque accepte #120). Toutes
+sont de l'outillage de build/dev : rien dans l'APK.
 
 La remediation passe par des overrides de plancher dans `package.json` :
-`esbuild`, `@xmldom/xmldom`, `uuid`, `postcss`, `js-yaml`, `brace-expansion`,
-`@babel/core`, `browserslist@^4.28.7`, `@react-navigation/core@^7.22.1`, et les 14
+`esbuild`, `@xmldom/xmldom@^0.8.15`, `uuid`, `postcss`, `js-yaml` (3.15.2 / 4.3.2), `brace-expansion` (1.1.21 / 2.1.7 / 5.0.12),
+`@babel/core`, `browserslist@^4.28.7`, `@react-navigation/core@^7.22.1`,
+`http-cache-semantics@^4` (4.3.0), `postcss-selector-parser@^6` (6.1.3), `source-map-js@^1` (1.2.2),
+`react-devtools-core > shell-quote` (^1.11.0), `@expo/cli > compression` (^1.8.2), et les 14
 paquets `metro@^0.83.8`. Le smoke test verrouille la chaine de build (presets Expo
-hoistes a la racine, un seul SDK Expo, metro 0.83.x partout).
+hoistes a la racine, un seul SDK Expo, metro 0.83.x partout) et les planchers
+`brace-expansion` / `undici` / `http-cache-semantics` / `postcss-selector-parser` /
+`shell-quote` / `compression` / `source-map-js` (plancher + appel de l'API consommee) /
+comportement de `minimatch` (majeurs 3, 9, 10).
 
 **Caveat sur l'override metro** (releve par la review de PR #114) : `0.83.3 -> 0.83.8`
 n'est pas un bump de patch pur cote API privee. Trois shims de `@expo/metro@54.2.0`,
@@ -31,18 +36,21 @@ Coolify malgre la spec). Procedure en memoire `simpl-liste-web-deploy`.
 
 ## Decisions recentes
 
+- 2026-10-06 : #133, #134, #135 fermees (PR #138 merged) — `shell-quote` ^1.11.0 (CRITICAL GHSA-pqg4, releve le plancher de #95), `@expo/cli > compression` ^1.8.2 (HIGH), `source-map-js@^1.0.0` ^1.2.2 (HIGH, pipeline CSS). `npm audit` 43 -> 40, critical 0. Export identique octet pour octet (44 fichiers), serveur de dev sert le bundle en gzip. Ouvertes le meme jour en plancher : #136 (`postcss-selector-parser` GHSA-rj75, aucun correctif 6.x) et #137 (`sprintf-js`, tete publiee vulnerable). `/analyse-vulnerabilite` cherche desormais les antecedents fermes avant de proposer.
+- 2026-10-05 : #128 et #129 fermees (PR #131 merged) — planchers version-scoped `http-cache-semantics@^4.0.0` -> ^4.3.0 (GHSA-ch52 high : l'advisory ne liste aucun patch, mais 4.3.0 sort de la borne `<=4.2.0` ; tunnel `@expo/ngrok` seulement) et `postcss-selector-parser@^6.0.0` -> ^6.1.3 (low, pipeline tailwind). `npm audit` 33 -> 31. Preuve du livrable : bundle JS (`expo export --no-bytecode --clear`) identique octet pour octet. **Le hash `.hbc` n'est pas une preuve** : Hermes n'est pas deterministe ici (deux exports du meme arbre different).
+- 2026-10-05 : #126 fermee, acceptation de #120 maintenue — `decode-uri-component@0.5.0` est ESM pur, `query-string@7` le `require()`. Declencheur de sortie : `expo-router@58.0.13` (SDK 58) retire `query-string`, pas encore backporte sur sdk-54..57. #130 ouverte : `braces` plancher (3.0.3 = tete publiee, vulnerable).
+- 2026-10-02 : #124 et #125 fermees (PR #127 merged) — planchers `brace-expansion` ^1.1.21 / ^2.1.7 / ^5.0.12 (9 advisories DoS neuves, toujours version-scoped) et `@expo/cli > undici` ^6.28.1 (resolu 6.29.0). Outillage de build seulement. Trois gardes au smoke test, dont le test `minimatch` qui manquait depuis #103. `npm audit` 12 -> 10. Ouvertes le meme jour : #123 (`node-forge`, tete publiee 1.4.0 vulnerable) et #126 (`decode-uri-component@0.5.0` publiee).
+- 2026-09-27 : #120 fermee en risque accepte (rectification du cadrage « attend un bump de SDK »). Aucune version d'expo-router (jusqu'a 58.0.8 / sdk-57) ne quitte `query-string@7`. expo-router n'appelle que `queryString.stringify()`, qui ne touche jamais `decode-uri-component` (le seul `parse()` du fork est commente) : code vulnerable inatteignable. A re-verifier a chaque bump d'expo-router.
+- 2026-09-25 : #121 fermee (PR #122 merged) — planchers `@xmldom/xmldom@^0.8.15` et `js-yaml` ^3.15.2 / ^4.3.2 (advisories HIGH du 2026-09-08, outillage de build seulement, hash du bundle Hermes inchange). Le Defenseur ne les avait pas signalees : hypothese de dedup par paquet contre issues fermees -> agent-defenseurs#139.
 - 2026-09-25 : #117 fermee (PR #119 merged) — override `@react-navigation/core@^7.22.1`, qui ne depend plus de `query-string` (GHSA-vcc3-ghjq-m6fr). Lock : 2 entrees. PR #118 du Defenseur fermee : son `npm audit fix` global desinstallait `babel-preset-expo`/`@expo/metro-config` de la racine et nichait un Expo 57 (build casse, tests verts). Gardes de toolchain ajoutees au smoke test. Residu `expo-router` -> #120.
 - 2026-09-04 : #115 ouverte + PR #116 — `browserslist@^4.28.7` (2 advisories HIGH publiees le 2026-09-01, `first_patched_version = 4.28.7`). Resout en 4.28.9, derniere HIGH de l'arbre. Bundle Hermes au hash identique avant/apres : cibles de compilation inchangees.
 - 2026-09-04 : #112 fermee doublon de #108 ; PR #113 fermee sans merge (son diff ne contenait aucune occurrence d'`image-size` — 633/584 de churn de lockfile sans rapport).
 - 2026-09-04 : #108 fermee (PR #114 merged) — `image-size` retiree de l'arbre via overrides `metro@^0.83.8`. Le blocage upstream tient toujours (`first_patched_version = None`, `2.0.2` reste la derniere publiee) ; c'est metro qui a **supprime** la dependance et vendore un parseur reduit sans les formats ICNS/JXL/HEIF vises. Backport sur la ligne 0.83.x le 2026-08-19 — pas besoin du bump de SDK Expo anticipe. 9 HIGH -> 1 HIGH.
-- 2026-07-27 : #68 merged (PR #101) — Feedback Hub integre (bouton Reglages > A propos, POST feedback.lacompagniemaximus.com app_id simpl-liste, opt-in contexte + identite Loi 25 ; client sans dependance teste via node:test).
-- 2026-05-30 : #90 merged (PR #93, ThemeToggle eslint-disable) + premier deploy web depuis 7 sem (rsync source/ + docker compose --build sur VPS) — #70 et #90 live sur liste.lacompagniemaximus.com.
-- 2026-05-30 : PR #89 merged — display name web resolu via userInfo (ordre fallback de la vitrine), fix #70.
-- 2026-05-30 : nettoyage lint web/ (PR #91, 2 prefer-const + import inutilise) ; #90 analyse (ThemeToggle set-state-in-effect, decision : eslint-disable documente).
-- 2026-05-10 : Aligne 6 patches Expo SDK 54 via expo install --fix — expo-doctor 17/17 (ref #87)
-- 2026-05-08 : Defenseur rerun confirme 0 findings — overrides existants suffisent, pas de PR necessaire (ref #81)
 
 ## Blockers actifs
 
-- #120 (`status:blocked`) : `decode-uri-component` via `expo-router` 6.0.x -> `query-string@7`. Seul correctif (0.5.0) ESM-only, non overridable ; attend un bump de SDK Expo.
 - Essai sur appareil a faire avant le prochain APK : core 7.22.1 tourne avec native/native-stack/bottom-tabs publies contre 7.14 (deep link vers une tache, onglets, pile).
+- #130 : `braces` <=3.0.3 sans version corrigee. Surveiller `braces` > 3.0.3 ou `micromatch` qui la largue.
+- #123 : `node-forge` <=1.4.0 sans version corrigee. Surveiller `node-forge` > 1.4.0 ou le retrait de la dependance par `@expo/code-signing-certificates` / `@expo/cli`.
+- #136 : `postcss-selector-parser` GHSA-rj75 sans correctif 6.x. Surveiller un backport 6.x ou la migration NativeWind 5 / tailwind 4.
+- #137 : `sprintf-js` <=1.1.3 sans version corrigee. Surveiller une version hors borne ou une `@istanbuljs/load-nyc-config` 2.x.

package-lock.json

@@ -3289,9 +3289,9 @@
       }
     },
     "node_modules/@react-native/codegen/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -4338,9 +4338,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -4861,14 +4861,15 @@
       }
     },
     "node_modules/compression": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
-      "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz",
+      "integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
         "compressible": "~2.0.18",
         "debug": "2.6.9",
+        "destroy": "1.2.0",
         "negotiator": "~0.6.4",
         "on-headers": "~1.1.0",
         "safe-buffer": "5.2.1",
@@ -4876,6 +4877,10 @@
       },
       "engines": {
         "node": ">= 0.8.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/compression/node_modules/debug": {
@@ -6404,9 +6409,9 @@
       }
     },
     "node_modules/expo/node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -7068,9 +7073,9 @@
       }
     },
     "node_modules/http-cache-semantics": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
+      "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
       "license": "BSD-2-Clause"
     },
     "node_modules/http-errors": {
@@ -9682,9 +9687,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
@@ -10557,9 +10562,9 @@
       }
     },
     "node_modules/react-native/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -10977,9 +10982,9 @@
       }
     },
     "node_modules/rimraf/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -11283,9 +11288,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
-      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz",
+      "integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11354,9 +11359,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -11703,9 +11708,9 @@
       }
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -11931,9 +11936,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
-      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "version": "6.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
+      "integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

package.json

@@ -71,20 +71,24 @@
     "@xmldom/xmldom": "^0.8.15",
     "uuid": "^11.1.1",
     "postcss": "^8.5.18",
+    "postcss-selector-parser@^6.0.0": "^6.1.3",
+    "source-map-js@^1.0.0": "^1.2.2",
+    "http-cache-semantics@^4.0.0": "^4.3.0",
     "js-yaml@^3.0.0": "^3.15.2",
     "js-yaml@^4.0.0": "^4.3.2",
-    "brace-expansion@^1.0.0": "^1.1.18",
-    "brace-expansion@^2.0.0": "^2.1.4",
-    "brace-expansion@^5.0.0": "^5.0.9",
+    "brace-expansion@^1.0.0": "^1.1.21",
+    "brace-expansion@^2.0.0": "^2.1.7",
+    "brace-expansion@^5.0.0": "^5.0.12",
     "@babel/core": "^7.29.6",
     "browserslist": "^4.28.7",
     "@expo/cli": {
+      "compression": "^1.8.2",
       "ws": "^8.20.1",
-      "undici": "^6.28.0",
+      "undici": "^6.28.1",
       "tar": "^7.5.21"
     },
     "react-devtools-core": {
-      "shell-quote": "^1.8.4",
+      "shell-quote": "^1.11.0",
       "ws": "^7.5.11"
     },
     "react-native": {

tests/smoke.test.cjs

@@ -264,6 +264,158 @@ check('@react-navigation/core deep link round trip keeps query params', () => {
   assert.equal(getPathFromState(state, config), '/task/abc?x=1&y=a%20b');
 });
 
+// --- Override floors for build-tool transitive deps (#124, #125) ---
+// brace-expansion is overridden per major (version-scoped): a blanket override
+// forces one major onto every minimatch and breaks minimatch@3 (#103). The
+// floors below are the patched head of each major; any other major is either
+// vulnerable (4.x) or unexpected, and must fail loudly.
+
+function versionAtLeast(version, floor) {
+  const a = version.split('.').map(Number);
+  const b = floor.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return true;
+}
+
+const BRACE_EXPANSION_FLOORS = { 1: '1.1.21', 2: '2.1.7', 5: '5.0.12' };
+
+check('every installed brace-expansion copy is at or above its major floor', () => {
+  const copies = installedCopies('brace-expansion');
+  assert.ok(copies.length > 0, 'brace-expansion is not installed');
+  const strays = copies.filter((c) => {
+    const floor = BRACE_EXPANSION_FLOORS[majorOf(c.version)];
+    return !floor || !versionAtLeast(c.version, floor);
+  });
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    `expected floors ${JSON.stringify(BRACE_EXPANSION_FLOORS)}`
+  );
+});
+
+check('every installed undici copy is >= 6.28.1', () => {
+  const copies = installedCopies('undici');
+  assert.ok(copies.length > 0, 'undici is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '6.28.1'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'undici must be >= 6.28.1'
+  );
+});
+
+// --- Override floors (#128, #129) ---
+// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got).
+// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
+// any other major is unexpected and must fail loudly.
+
+check('every installed http-cache-semantics copy is >= 4.3.0', () => {
+  const copies = installedCopies('http-cache-semantics');
+  assert.ok(copies.length > 0, 'http-cache-semantics is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '4.3.0'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'http-cache-semantics must be >= 4.3.0'
+  );
+});
+
+check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () => {
+  const copies = installedCopies('postcss-selector-parser');
+  assert.ok(copies.length > 0, 'postcss-selector-parser is not installed');
+  const strays = copies.filter(
+    (c) => majorOf(c.version) !== '6' || !versionAtLeast(c.version, '6.1.3')
+  );
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'postcss-selector-parser must be 6.x >= 6.1.3'
+  );
+});
+
+// --- Override floors (#133, #134, #135) ---
+// shell-quote: scoped to react-devtools-core (raised from #95's ^1.8.4).
+// compression: scoped to @expo/cli (dev server middleware).
+// source-map-js: version-scoped to major 1 (postcss, tailwindcss pipeline).
+// Each floor is paired with a call to the API its consumer actually uses.
+
+check('every installed shell-quote copy is >= 1.11.0 and still quotes/parses', () => {
+  const copies = installedCopies('shell-quote');
+  assert.ok(copies.length > 0, 'shell-quote is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '1.11.0'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'shell-quote must be >= 1.11.0'
+  );
+  for (const c of copies) {
+    const { quote, parse } = require(c.dir);
+    const where = `shell-quote ${c.version} at ${path.relative(ROOT, c.dir)}`;
+    assert.equal(quote(['code', '-g', 'a b.js:1']), "code -g 'a b.js:1'", `${where}: quote`);
+    assert.deepEqual(parse('a "b c" d'), ['a', 'b c', 'd'], `${where}: parse`);
+  }
+});
+
+check('every installed compression copy is >= 1.8.2 and builds a middleware', () => {
+  const copies = installedCopies('compression');
+  assert.ok(copies.length > 0, 'compression is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '1.8.2'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'compression must be >= 1.8.2'
+  );
+  for (const c of copies) {
+    const middleware = require(c.dir)();
+    assert.equal(typeof middleware, 'function', `compression ${c.version}: middleware`);
+    assert.equal(middleware.length, 3, `compression ${c.version}: (req, res, next) signature`);
+  }
+});
+
+check('every installed source-map-js copy is 1.x >= 1.2.2 and round-trips a mapping', () => {
+  const copies = installedCopies('source-map-js');
+  assert.ok(copies.length > 0, 'source-map-js is not installed');
+  const strays = copies.filter(
+    (c) => majorOf(c.version) !== '1' || !versionAtLeast(c.version, '1.2.2')
+  );
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'source-map-js must be 1.x >= 1.2.2'
+  );
+  for (const c of copies) {
+    const { SourceMapGenerator, SourceMapConsumer } = require(c.dir);
+    const gen = new SourceMapGenerator({ file: 'out.css' });
+    gen.addMapping({
+      source: 'in.css',
+      original: { line: 3, column: 2 },
+      generated: { line: 1, column: 0 },
+    });
+    const pos = new SourceMapConsumer(gen.toJSON()).originalPositionFor({ line: 1, column: 0 });
+    const where = `source-map-js ${c.version} at ${path.relative(ROOT, c.dir)}`;
+    assert.deepEqual([pos.source, pos.line, pos.column], ['in.css', 3, 2], where);
+  }
+});
+
+// The call that broke under the blanket override: each minimatch copy must
+// still expand braces through its own brace-expansion major.
+check('every installed minimatch copy still matches globs and braces', () => {
+  const copies = installedCopies('minimatch');
+  const majors = [...new Set(copies.map((c) => majorOf(c.version)))].sort();
+  assert.deepEqual(majors, ['10', '3', '9'], 'expected minimatch majors 3, 9 and 10');
+  for (const c of copies) {
+    const mod = require(c.dir);
+    const minimatch = mod.minimatch || mod; // v3 exports the function itself
+    const where = `minimatch ${c.version} at ${path.relative(ROOT, c.dir)}`;
+    assert.equal(minimatch('foo/bar.js', '**/*.js'), true, `${where}: globstar`);
+    assert.equal(minimatch('a/b.js', 'a/{b,c}.js'), true, `${where}: brace match`);
+    assert.equal(minimatch('a/d.js', 'a/{b,c}.js'), false, `${where}: brace miss`);
+    assert.equal(minimatch('f3.js', 'f{1..3}.js'), true, `${where}: numeric range`);
+  }
+});
+
 if (failed === 0) {
   console.log('\nsmoke OK');
   process.exit(0);