chore: bump version to 1.6.4 (versionCode 16)

Includes Expo SDK 54 patch alignment from #87. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
state: sync after #87
2026-05-10 14:48:46 -04:00 · 2026-05-10 13:42:25 -04:00 · 2026-05-10 17:41:42 +00:00 · 2026-05-09 08:28:06 -04:00 · 2026-05-07 21:36:50 -04:00 · 2026-05-05 21:37:13 -04:00
7 changed files with 455 additions and 256 deletions
--- a/.claude/skills/eas-build/SKILL.md
+++ b/.claude/skills/eas-build/SKILL.md
@ -15,10 +15,39 @@ user-invocable: true

 1. Lire le `versionCode` actuel dans `app.json`
 2. Incrementer `versionCode` (+1) — doit etre strictement superieur
-3. Si demande par l'utilisateur : bumper `version` dans `app.json` + `package.json`
-4. Commit : `chore: bump versionCode to <N>`
-5. Build : `npx --yes eas-cli build --platform android --profile preview --non-interactive`
-6. Quand le build est termine : creer une release Forgejo avec le lien APK
+3. Si demande par l'utilisateur : bumper `version` dans `app.json` + `package.json` (et `npm install` pour synchroniser le lockfile)
+4. Commit : `chore: bump versionCode to <N>` (ou `chore: bump version to X.Y.Z (versionCode N)` si version aussi bumpee)
+5. Push commit sur master, puis tag `vX.Y.Z` et `git push origin vX.Y.Z`
+6. Build : `npx --yes eas-cli build --platform android --profile preview --non-interactive`
+7. Quand le build est termine : telecharger l'APK, creer la release Forgejo, attacher l'APK
+
+## Upload de l'APK — pattern resilient
+
+```bash
+# 1. Telecharger
+APK_URL=$(npx --yes eas-cli build:view <build_id> --json | jq -r '.artifacts.buildUrl')
+curl -L -o "/tmp/simpl-liste-vX.Y.Z.apk" "$APK_URL"
+
+# 2. Creer la release
+TOKEN=$(cat ~/.forgejo-token)
+RELEASE_ID=$(curl -s -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+  "https://git.lacompagniemaximus.com/api/v1/repos/maximus/simpl-liste/releases" \
+  -d '{"tag_name":"vX.Y.Z","name":"vX.Y.Z","body":"...","draft":false,"prerelease":false}' \
+  | jq -r '.id')
+
+# 3. Attacher l'APK — RETRY sur 502/504 (variance reseau, pas un probleme infra)
+for i in 1 2 3 4 5; do
+  http=$(curl -X POST -H "Authorization: token $TOKEN" \
+    "https://git.lacompagniemaximus.com/api/v1/repos/maximus/simpl-liste/releases/$RELEASE_ID/assets?name=simpl-liste-vX.Y.Z.apk" \
+    -F "attachment=@/tmp/simpl-liste-vX.Y.Z.apk" \
+    -o /tmp/asset-resp.json -w "%{http_code}" --max-time 300)
+  case "$http" in
+    201) echo "Upload OK"; break;;
+    502|504) echo "Attempt $i: gateway timeout, retry"; sleep 5;;
+    *) echo "Unexpected: HTTP $http"; cat /tmp/asset-resp.json; break;;
+  esac
+done
+```

 ## Regles

@ -26,3 +55,22 @@ user-invocable: true
 - `autoIncrement` dans eas.json ne s'applique qu'au profil `production`, pas `preview`
 - Toujours utiliser `npx --yes eas-cli` (pas d'install globale)
 - Ne JAMAIS `git push --tags` — push les tags un par un si necessaire
+
+## Gotcha — Upload APK : 502/504 transitoire
+
+**Symptome** : `curl -X POST ... -F "attachment=@<apk>"` retourne HTTP 502 ou 504 apres ~60s. La progression curl montre upload coupe a 50-90% de progression. Affecte typiquement les APK ~90MB+.
+
+**Cause** : Traefik (devant Forgejo via Coolify) a un timeout de gateway de 60s sur la fin de requete. Quand la vitesse upload tombe sous ~1.5 MB/s (variance reseau classique sur connexions residentielles), un APK de 92 MB depasse le seuil et la requete est coupee. **Ce n'est pas un probleme de config infra** — c'est purement la vitesse upload du client a un instant donne.
+
+**Fix** : retry. La 2e ou 3e tentative passe quand la bande passante remonte (j'ai mesure 1.3 MB/s puis 17 MB/s a quelques minutes d'intervalle). Le pattern `for i in 1..5` ci-dessus est suffisant — pas besoin de toucher a Traefik ni Forgejo.
+
+**Verification que c'est bien le bon probleme** :
+- L'APK precedent (~97 MB) a ete uploade avec succes les semaines passees → infra OK
+- Un fichier de test de 11 octets sur la meme release passe en 0.1s → API OK
+- HTTP 502 ou 504 apres 60s exactement → timeout gateway, pas erreur de logique
+- Vitesse upload curl reportee < 1.5 MB/s → confirme la cause
+
+**Path API a connaitre** :
+- Creer release : `POST /repos/{owner}/{repo}/releases` (renvoie `.id`)
+- Attacher asset : `POST /repos/{owner}/{repo}/releases/{release_id}/assets?name=<filename>` (multipart `attachment`)
+- Supprimer asset : `DELETE /repos/{owner}/{repo}/releases/{release_id}/assets/{asset_id}` — **inclure le release_id dans le path**, pas seulement l'asset id, sinon HTTP 404
--- a/SECURITY.md
+++ b/SECURITY.md
@ -0,0 +1,50 @@
+# SECURITY — simpl-liste
+
+Rapport d'etat securite. Scanne quotidiennement par `defenseur-simpl-liste`
+(04:15 UTC) dans `~/claude-code/defenseurs/`.
+
+## CVE resolues
+
+### 2026-04-24 — Overrides `@xmldom/xmldom` et `uuid`
+
+Correction via `overrides` dans `package.json`. Aucune n'etait exploitable a
+runtime dans l'APK : chaine concernee est build-time (iOS build via xcode,
+Expo CLI, plist serialization) ou dev-tunnel (ngrok).
+
+| CVE | Severite | Package | Fix version | Etat |
+|---|---|---|---|---|
+| GHSA-2v35-w6hq-6mfw | HIGH | @xmldom/xmldom | ^0.8.13 | Resolu |
+| GHSA-f6ww-3ggp-fr8h | HIGH | @xmldom/xmldom | ^0.8.13 | Resolu |
+| GHSA-x6wf-f3px-wcqx | HIGH | @xmldom/xmldom | ^0.8.13 | Resolu |
+| GHSA-j759-j44w-7fr8 | HIGH | @xmldom/xmldom | ^0.8.13 | Resolu |
+| GHSA-w5hq-g745-h8pq | MEDIUM | uuid | ^11.0.0 | Mitigation partielle (voir ci-dessous) |
+
+## CVE residuelles
+
+### GHSA-w5hq-g745-h8pq — `uuid` buffer bounds check
+
+**Status** : mitigation partielle. L'advisory npm flag `uuid <14.0.0` meme apres
+override a `^11.0.0`. Bug concerne `uuid.v3() / v5() / v6()` quand `buf` param
+est fourni. Les consommateurs transitifs (`xcode`, `@expo/ngrok`) utilisent
+uniquement `uuid.v4()` — donc **pas de code path vulnerable atteint en pratique**.
+
+Non bump vers `^14.0.0` car ESM-only (casserait les imports CJS de xcode et
+ngrok dans la chaine build iOS). Voir spec decision D3 pour details.
+
+**Impact** : cascade via 18 advisories transitives (uuid → xcode/ngrok → expo/* → ...),
+toutes remontant a la meme racine. Non-bloquant pour la production.
+
+**Re-evaluation** : lors du prochain upgrade Expo SDK (quand xcode + ngrok
+passeront a une version compatible avec `uuid@^14` ou retireront uuid).
+
+## Procedure de scan manuel
+
+```bash
+cd ~/claude-code/defenseurs && npx tsx src/defenseur.ts defenseur-simpl-liste
+```
+
+## Politique de review
+
+- **HIGH** : fix immediat via PR.
+- **MEDIUM** : triage sous 7 jours, fix si exploitable.
+- **LOW** : accepte tel quel, documente ici.
--- a/STATE.md
+++ b/STATE.md
@ -0,0 +1,22 @@
+# STATE — simpl-liste
+
+> Derniere MAJ : 2026-05-10 (par fix-issue #87)
+
+## Position actuelle
+
+Version 1.6.1 (versionCode 13). Remediation vulnerabilites du defenseur en cours
+via overrides `@xmldom/xmldom@^0.8.13` et `uuid@^11.0.0` dans `package.json`
+(overnight 2026-04-24). 4 CVE HIGH xmldom nettoyees ; 1 advisory uuid residuelle
+non-exploitable en pratique (details dans `SECURITY.md`).
+
+## Decisions recentes
+
+- 2026-05-10 : Aligne 6 patches Expo SDK 54 via expo install --fix — expo-doctor 17/17 (ref #87)
+- 2026-05-08 : Defenseur rerun confirme 0 findings — overrides existants suffisent, pas de PR necessaire (ref #81)
+- 2026-04-24 : overrides xmldom + uuid (spec `spec-decisions-vuln-simpl-liste.md`) — PRs #77, #78, #79 (pending-human).
+- 2026-04-23 : PR #71 merged — fix widget render-optimiste + timing instrumentation.
+- 2026-04-18 : archive milestone `spec-simpl-liste-web` (12/12 done).
+
+## Blockers actifs
+
+Aucun.
--- a/app.json
+++ b/app.json
@ -2,7 +2,7 @@
  "expo": {
    "name": "Simpl-Liste",
    "slug": "simpl-liste",
-    "version": "1.6.1",
+    "version": "1.6.4",
    "orientation": "portrait",
    "icon": "./assets/images/icon.png",
    "scheme": "simplliste",
@ -24,7 +24,7 @@
        "backgroundColor": "#FFF8F0"
      },
      "edgeToEdgeEnabled": true,
-      "versionCode": 13
+      "versionCode": 16
    },
    "plugins": [
      "expo-router",
--- a/package-lock.json
+++ b/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "simpl-liste",
-  "version": "1.6.1",
+  "version": "1.6.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "simpl-liste",
-      "version": "1.6.1",
+      "version": "1.6.3",
      "dependencies": {
        "@expo-google-fonts/inter": "^0.4.2",
        "@expo/ngrok": "^4.1.3",
@ -17,25 +17,25 @@
        "@react-navigation/native": "^7.1.8",
        "date-fns": "^4.1.0",
        "drizzle-orm": "^0.45.2",
-        "expo": "~54.0.33",
-        "expo-auth-session": "~7.0.10",
+        "expo": "~54.0.34",
+        "expo-auth-session": "~7.0.11",
        "expo-calendar": "~15.0.8",
        "expo-constants": "~18.0.13",
-        "expo-crypto": "~15.0.8",
+        "expo-crypto": "~15.0.9",
        "expo-file-system": "~19.0.21",
        "expo-font": "~14.0.11",
        "expo-haptics": "~15.0.8",
        "expo-intent-launcher": "~13.0.8",
-        "expo-linking": "~8.0.11",
+        "expo-linking": "~8.0.12",
        "expo-localization": "~17.0.8",
-        "expo-notifications": "~0.32.16",
+        "expo-notifications": "~0.32.17",
        "expo-router": "~6.0.23",
        "expo-secure-store": "~15.0.8",
        "expo-sharing": "~14.0.8",
        "expo-splash-screen": "~31.0.13",
        "expo-sqlite": "~16.0.10",
        "expo-status-bar": "~3.0.9",
-        "expo-web-browser": "~15.0.10",
+        "expo-web-browser": "~15.0.11",
        "i18next": "^25.8.13",
        "lucide-react-native": "^0.575.0",
        "nativewind": "^4.2.2",
@ -2202,9 +2202,9 @@
      }
    },
    "node_modules/@expo/fingerprint": {
-      "version": "0.15.4",
-      "resolved": "https://registry.npmjs.org/@expo/fingerprint/-/fingerprint-0.15.4.tgz",
-      "integrity": "sha512-eYlxcrGdR2/j2M6pEDXo9zU9KXXF1vhP+V+Tl+lyY+bU8lnzrN6c637mz6Ye3em2ANy8hhUR03Raf8VsT9Ogng==",
+      "version": "0.15.5",
+      "resolved": "https://registry.npmjs.org/@expo/fingerprint/-/fingerprint-0.15.5.tgz",
+      "integrity": "sha512-mdVoAMcux1WlM6kd1RoWiHRNqKqS+J6mKmWQ/BKgeh937S/fcW58EE68O6nc4KDXtWi3PBeNHskOFcgyIuD4hw==",
      "license": "MIT",
      "dependencies": {
        "@expo/spawn-async": "^1.7.2",
@ -2214,7 +2214,7 @@
        "getenv": "^2.0.0",
        "glob": "^13.0.0",
        "ignore": "^5.3.1",
-        "minimatch": "^9.0.0",
+        "minimatch": "^10.2.2",
        "p-limit": "^3.1.0",
        "resolve-from": "^5.0.0",
        "semver": "^7.6.0"
@ -2224,9 +2224,9 @@
      }
    },
    "node_modules/@expo/fingerprint/node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
@ -2266,24 +2266,15 @@
      }
    },
    "node_modules/@expo/json-file": {
-      "version": "10.0.8",
-      "resolved": "https://registry.npmjs.org/@expo/json-file/-/json-file-10.0.8.tgz",
-      "integrity": "sha512-9LOTh1PgKizD1VXfGQ88LtDH0lRwq9lsTb4aichWTWSWqy3Ugfkhfm3BhzBIkJJfQQ5iJu3m/BoRlEIjoCGcnQ==",
+      "version": "10.0.14",
+      "resolved": "https://registry.npmjs.org/@expo/json-file/-/json-file-10.0.14.tgz",
+      "integrity": "sha512-yWwBFywFv+SxkJp/pIzzA416JVYflNUh7pqQzgaA6nXDqRyK7KfrqVzk8PdUfDnqbBcaZZxpzNssfQZzp5KHrA==",
      "license": "MIT",
      "dependencies": {
-        "@babel/code-frame": "~7.10.4",
+        "@babel/code-frame": "^7.20.0",
        "json5": "^2.2.3"
      }
    },
-    "node_modules/@expo/json-file/node_modules/@babel/code-frame": {
-      "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.10.4.tgz",
-      "integrity": "sha512-vG6SvB6oYEhvgisZNFRmRCUkLz11c7rp+tbNTynGqc6mS1d5ATd/sGyV6W0KZZnXRKMTzZDRgQT3Ou9jhpAfUg==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/highlight": "^7.10.4"
-      }
-    },
    "node_modules/@expo/metro": {
      "version": "54.2.0",
      "resolved": "https://registry.npmjs.org/@expo/metro/-/metro-54.2.0.tgz",
@ -2307,9 +2298,9 @@
      }
    },
    "node_modules/@expo/metro-config": {
-      "version": "54.0.14",
-      "resolved": "https://registry.npmjs.org/@expo/metro-config/-/metro-config-54.0.14.tgz",
-      "integrity": "sha512-hxpLyDfOR4L23tJ9W1IbJJsG7k4lv2sotohBm/kTYyiG+pe1SYCAWsRmgk+H42o/wWf/HQjE5k45S5TomGLxNA==",
+      "version": "54.0.15",
+      "resolved": "https://registry.npmjs.org/@expo/metro-config/-/metro-config-54.0.15.tgz",
+      "integrity": "sha512-SqIya4VZ9KHM1S9g+xR0A+QKw1Tfs7Gacx6bQNJ98vs4+O7I5+QP5mHZIB0QSZLUV8opiXebHYTiTu+0OAsIUw==",
      "license": "MIT",
      "dependencies": {
        "@babel/code-frame": "^7.20.0",
@ -2330,7 +2321,7 @@
        "hermes-parser": "^0.29.1",
        "jsc-safe-url": "^0.2.4",
        "lightningcss": "^1.30.1",
-        "minimatch": "^9.0.0",
+        "picomatch": "^4.0.3",
        "postcss": "~8.4.32",
        "resolve-from": "^5.0.0"
      },
@ -2343,6 +2334,18 @@
        }
      }
    },
+    "node_modules/@expo/metro-config/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
    "node_modules/@expo/metro-runtime": {
      "version": "6.1.2",
      "resolved": "https://registry.npmjs.org/@expo/metro-runtime/-/metro-runtime-6.1.2.tgz",
@ -2534,16 +2537,6 @@
        "win32"
      ]
    },
-    "node_modules/@expo/ngrok/node_modules/uuid": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
-      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
-      "license": "MIT",
-      "bin": {
-        "uuid": "bin/uuid"
-      }
-    },
    "node_modules/@expo/ngrok/node_modules/yaml": {
      "version": "1.10.3",
      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
@ -2554,25 +2547,24 @@
      }
    },
    "node_modules/@expo/osascript": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/@expo/osascript/-/osascript-2.3.8.tgz",
-      "integrity": "sha512-/TuOZvSG7Nn0I8c+FcEaoHeBO07yu6vwDgk7rZVvAXoeAK5rkA09jRyjYsZo+0tMEFaToBeywA6pj50Mb3ny9w==",
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/@expo/osascript/-/osascript-2.4.3.tgz",
+      "integrity": "sha512-wbuj3EebM7W9hN/Wp4xTzKd6rQ2zKJzAxkFxkOOwyysLp0HOAgQ4/5RINyoS241pZUX2rUHq7mAJ7pcCQ8U0Ow==",
      "license": "MIT",
      "dependencies": {
-        "@expo/spawn-async": "^1.7.2",
-        "exec-async": "^2.2.0"
+        "@expo/spawn-async": "^1.7.2"
      },
      "engines": {
        "node": ">=12"
      }
    },
    "node_modules/@expo/package-manager": {
-      "version": "1.9.10",
-      "resolved": "https://registry.npmjs.org/@expo/package-manager/-/package-manager-1.9.10.tgz",
-      "integrity": "sha512-axJm+NOj3jVxep49va/+L3KkF3YW/dkV+RwzqUJedZrv4LeTqOG4rhrCaCPXHTvLqCTDKu6j0Xyd28N7mnxsGA==",
+      "version": "1.10.5",
+      "resolved": "https://registry.npmjs.org/@expo/package-manager/-/package-manager-1.10.5.tgz",
+      "integrity": "sha512-nCP9Mebfl3jvOr0/P6VAuyah6PAtun+aihIL2zAtuE8uSe94JWkVZ7051i0MUVO+y3gFpBqnr8IIH5ch+VJjHA==",
      "license": "MIT",
      "dependencies": {
-        "@expo/json-file": "^10.0.8",
+        "@expo/json-file": "^10.0.14",
        "@expo/spawn-async": "^1.7.2",
        "chalk": "^4.0.0",
        "npm-package-arg": "^11.0.0",
@ -2672,9 +2664,9 @@
      "license": "MIT"
    },
    "node_modules/@expo/xcpretty": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/@expo/xcpretty/-/xcpretty-4.4.0.tgz",
-      "integrity": "sha512-o2qDlTqJ606h4xR36H2zWTywmZ3v3842K6TU8Ik2n1mfW0S580VHlt3eItVYdLYz+klaPp7CXqanja8eASZjRw==",
+      "version": "4.4.4",
+      "resolved": "https://registry.npmjs.org/@expo/xcpretty/-/xcpretty-4.4.4.tgz",
+      "integrity": "sha512-4aQzz9vgxcNXFfo/iyNgDDYfsU5XGKKxWxZopw0cVotHiW+U8IJbIxMaxsINs6bHhtkG3StKNPcOrn3eBuxKPw==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "@babel/code-frame": "^7.20.0",
@ -3816,9 +3808,9 @@
      }
    },
    "node_modules/@xmldom/xmldom": {
-      "version": "0.8.12",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz",
-      "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==",
+      "version": "0.8.13",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz",
+      "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==",
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
@ -4356,12 +4348,24 @@
      }
    },
    "node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
      "license": "MIT",
      "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/brace-expansion/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/braces": {
@ -5722,36 +5726,30 @@
        "node": ">=6"
      }
    },
-    "node_modules/exec-async": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/exec-async/-/exec-async-2.2.0.tgz",
-      "integrity": "sha512-87OpwcEiMia/DeiKFzaQNBNFeN3XkkpYIh9FyOqq5mS2oKv3CBE67PXoEKcr6nodWdXNogTiQ0jE2NGuoffXPw==",
-      "license": "MIT"
-    },
    "node_modules/expo": {
-      "version": "54.0.33",
-      "resolved": "https://registry.npmjs.org/expo/-/expo-54.0.33.tgz",
-      "integrity": "sha512-3yOEfAKqo+gqHcV8vKcnq0uA5zxlohnhA3fu4G43likN8ct5ZZ3LjAh9wDdKteEkoad3tFPvwxmXW711S5OHUw==",
+      "version": "54.0.34",
+      "resolved": "https://registry.npmjs.org/expo/-/expo-54.0.34.tgz",
+      "integrity": "sha512-XkVHguZZDC8BcTQxHAd14/TQFbDp1Wt0Z/KApO9t68Ll5A127hLCPzU+a9gytfCIiyL/V1IpF1vIcOLKEVAoNQ==",
      "license": "MIT",
      "dependencies": {
        "@babel/runtime": "^7.20.0",
-        "@expo/cli": "54.0.23",
+        "@expo/cli": "54.0.24",
        "@expo/config": "~12.0.13",
        "@expo/config-plugins": "~54.0.4",
        "@expo/devtools": "0.1.8",
-        "@expo/fingerprint": "0.15.4",
+        "@expo/fingerprint": "0.15.5",
        "@expo/metro": "~54.2.0",
-        "@expo/metro-config": "54.0.14",
+        "@expo/metro-config": "54.0.15",
        "@expo/vector-icons": "^15.0.3",
        "@ungap/structured-clone": "^1.3.0",
        "babel-preset-expo": "~54.0.10",
-        "expo-asset": "~12.0.12",
+        "expo-asset": "~12.0.13",
        "expo-constants": "~18.0.13",
-        "expo-file-system": "~19.0.21",
+        "expo-file-system": "~19.0.22",
        "expo-font": "~14.0.11",
        "expo-keep-awake": "~15.0.8",
-        "expo-modules-autolinking": "3.0.24",
-        "expo-modules-core": "3.0.29",
+        "expo-modules-autolinking": "3.0.25",
+        "expo-modules-core": "3.0.30",
        "pretty-format": "^29.7.0",
        "react-refresh": "^0.14.2",
        "whatwg-url-without-unicode": "8.0.0-3"
@ -5790,13 +5788,13 @@
      }
    },
    "node_modules/expo-asset": {
-      "version": "12.0.12",
-      "resolved": "https://registry.npmjs.org/expo-asset/-/expo-asset-12.0.12.tgz",
-      "integrity": "sha512-CsXFCQbx2fElSMn0lyTdRIyKlSXOal6ilLJd+yeZ6xaC7I9AICQgscY5nj0QcwgA+KYYCCEQEBndMsmj7drOWQ==",
+      "version": "12.0.13",
+      "resolved": "https://registry.npmjs.org/expo-asset/-/expo-asset-12.0.13.tgz",
+      "integrity": "sha512-x/p7WvQUnkn6K43b9eL6SPeq5Vnf1E8BDe9bDrWrvMqzyUvJnUFvl+ctg3034s/+UHe7Ne2pAmc0+yzbl8CrDQ==",
      "license": "MIT",
      "dependencies": {
        "@expo/image-utils": "^0.8.8",
-        "expo-constants": "~18.0.12"
+        "expo-constants": "~18.0.13"
      },
      "peerDependencies": {
        "expo": "*",
@ -5805,16 +5803,16 @@
      }
    },
    "node_modules/expo-auth-session": {
-      "version": "7.0.10",
-      "resolved": "https://registry.npmjs.org/expo-auth-session/-/expo-auth-session-7.0.10.tgz",
-      "integrity": "sha512-XDnKkudvhHSKkZfJ+KkodM+anQcrxB71i+h0kKabdLa5YDXTQ81aC38KRc3TMqmnBDHAu0NpfbzEVd9WDFY3Qg==",
+      "version": "7.0.11",
+      "resolved": "https://registry.npmjs.org/expo-auth-session/-/expo-auth-session-7.0.11.tgz",
+      "integrity": "sha512-AhWtt/m9rb1Po77X/VBFbeE6UTgbm2vXP2iCblUSRsHCw2qD6lO0ulKUB8Xyxy9FtoI9yrNQ1iwCNgIIgo8VYQ==",
      "license": "MIT",
      "dependencies": {
        "expo-application": "~7.0.8",
-        "expo-constants": "~18.0.11",
-        "expo-crypto": "~15.0.8",
-        "expo-linking": "~8.0.10",
-        "expo-web-browser": "~15.0.10",
+        "expo-constants": "~18.0.13",
+        "expo-crypto": "~15.0.9",
+        "expo-linking": "~8.0.12",
+        "expo-web-browser": "~15.0.11",
        "invariant": "^2.2.4"
      },
      "peerDependencies": {
@ -5847,9 +5845,9 @@
      }
    },
    "node_modules/expo-crypto": {
-      "version": "15.0.8",
-      "resolved": "https://registry.npmjs.org/expo-crypto/-/expo-crypto-15.0.8.tgz",
-      "integrity": "sha512-aF7A914TB66WIlTJvl5J6/itejfY78O7dq3ibvFltL9vnTALJ/7LYHvLT4fwmx9yUNS6ekLBtDGWivFWnj2Fcw==",
+      "version": "15.0.9",
+      "resolved": "https://registry.npmjs.org/expo-crypto/-/expo-crypto-15.0.9.tgz",
+      "integrity": "sha512-SNWKa2fXx7v9gkp1h/7nqXY5XN7qgNDn3yRc2aO0gWGbeMbvob/haMxxsPFe9f51aqH5NjNCqHf2kvLhvAd8KQ==",
      "license": "MIT",
      "dependencies": {
        "base64-js": "^1.3.0"
@ -5859,9 +5857,9 @@
      }
    },
    "node_modules/expo-file-system": {
-      "version": "19.0.21",
-      "resolved": "https://registry.npmjs.org/expo-file-system/-/expo-file-system-19.0.21.tgz",
-      "integrity": "sha512-s3DlrDdiscBHtab/6W1osrjGL+C2bvoInPJD7sOwmxfJ5Woynv2oc+Fz1/xVXaE/V7HE/+xrHC/H45tu6lZzzg==",
+      "version": "19.0.22",
+      "resolved": "https://registry.npmjs.org/expo-file-system/-/expo-file-system-19.0.22.tgz",
+      "integrity": "sha512-l9pgahSc7sJD0bP9vBNeXvZjy8QKDpVHVxWmei/ESQOrzmoj5BidziqLVsyZdxsi+PfdbTtttLTAmddH/JafYA==",
      "license": "MIT",
      "peerDependencies": {
        "expo": "*",
@ -5911,12 +5909,12 @@
      }
    },
    "node_modules/expo-linking": {
-      "version": "8.0.11",
-      "resolved": "https://registry.npmjs.org/expo-linking/-/expo-linking-8.0.11.tgz",
-      "integrity": "sha512-+VSaNL5om3kOp/SSKO5qe6cFgfSIWnnQDSbA7XLs3ECkYzXRquk5unxNS3pg7eK5kNUmQ4kgLI7MhTggAEUBLA==",
+      "version": "8.0.12",
+      "resolved": "https://registry.npmjs.org/expo-linking/-/expo-linking-8.0.12.tgz",
+      "integrity": "sha512-FpXeIpFgZuxihwT9lBo86YD3y6LphBuAhN680MMxm/Y7fmsc57vimn2d3vFu68VI0+Z9w457t494mu2wvlgWTQ==",
      "license": "MIT",
      "dependencies": {
-        "expo-constants": "~18.0.12",
+        "expo-constants": "~18.0.13",
        "invariant": "^2.2.4"
      },
      "peerDependencies": {
@ -5938,9 +5936,9 @@
      }
    },
    "node_modules/expo-modules-autolinking": {
-      "version": "3.0.24",
-      "resolved": "https://registry.npmjs.org/expo-modules-autolinking/-/expo-modules-autolinking-3.0.24.tgz",
-      "integrity": "sha512-TP+6HTwhL7orDvsz2VzauyQlXJcAWyU3ANsZ7JGL4DQu8XaZv/A41ZchbtAYLfozNA2Ya1Hzmhx65hXryBMjaQ==",
+      "version": "3.0.25",
+      "resolved": "https://registry.npmjs.org/expo-modules-autolinking/-/expo-modules-autolinking-3.0.25.tgz",
+      "integrity": "sha512-YmHWctJlwvOuLZccg3cOXvSiXVJrPMKl7g2YR0YHWoGL9v2RvcmgaPJWPSLVW+voNEgEPsbo5UmUrAqbnYcBeg==",
      "license": "MIT",
      "dependencies": {
        "@expo/spawn-async": "^1.7.2",
@ -5954,9 +5952,9 @@
      }
    },
    "node_modules/expo-modules-core": {
-      "version": "3.0.29",
-      "resolved": "https://registry.npmjs.org/expo-modules-core/-/expo-modules-core-3.0.29.tgz",
-      "integrity": "sha512-LzipcjGqk8gvkrOUf7O2mejNWugPkf3lmd9GkqL9WuNyeN2fRwU0Dn77e3ZUKI3k6sI+DNwjkq4Nu9fNN9WS7Q==",
+      "version": "3.0.30",
+      "resolved": "https://registry.npmjs.org/expo-modules-core/-/expo-modules-core-3.0.30.tgz",
+      "integrity": "sha512-a6IrpAn/Jbmwxi9L+hMmXKpNqnkUpoF7WHOpn02rVLyax2J0gB1vvCVE5rNydplEnt41Q6WxQwvcOjZaIkcSUg==",
      "license": "MIT",
      "dependencies": {
        "invariant": "^2.2.4"
@ -5967,9 +5965,9 @@
      }
    },
    "node_modules/expo-notifications": {
-      "version": "0.32.16",
-      "resolved": "https://registry.npmjs.org/expo-notifications/-/expo-notifications-0.32.16.tgz",
-      "integrity": "sha512-QQD/UA6v7LgvwIJ+tS7tSvqJZkdp0nCSj9MxsDk/jU1GttYdK49/5L2LvE/4U0H7sNBz1NZAyhDZozg8xgBLXw==",
+      "version": "0.32.17",
+      "resolved": "https://registry.npmjs.org/expo-notifications/-/expo-notifications-0.32.17.tgz",
+      "integrity": "sha512-lwwzn7tImuzTzn9PAglZlS2VfZEvsfFGJTK9Eb8I4cqkGh2DI23YJFJH+WPEIu4QhDvk5JeBjklenJ8IZbmA4A==",
      "license": "MIT",
      "dependencies": {
        "@expo/image-utils": "^0.8.8",
@ -6249,9 +6247,9 @@
      }
    },
    "node_modules/expo-server": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/expo-server/-/expo-server-1.0.5.tgz",
-      "integrity": "sha512-IGR++flYH70rhLyeXF0Phle56/k4cee87WeQ4mamS+MkVAVP+dDlOHf2nN06Z9Y2KhU0Gp1k+y61KkghF7HdhA==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/expo-server/-/expo-server-1.0.6.tgz",
+      "integrity": "sha512-vb5TBtskvEdzYuW79lATXutOEBfW5m6U4EFpNjCVZTnI7S//SAsLQkYEpn+EDfn84m6VQfzSGkIVR6YPaScKFA==",
      "license": "MIT",
      "engines": {
        "node": ">=20.16.0"
@ -6306,9 +6304,9 @@
      }
    },
    "node_modules/expo-web-browser": {
-      "version": "15.0.10",
-      "resolved": "https://registry.npmjs.org/expo-web-browser/-/expo-web-browser-15.0.10.tgz",
-      "integrity": "sha512-fvDhW4bhmXAeWFNFiInmsGCK83PAqAcQaFyp/3pE/jbdKmFKoRCWr46uZGIfN4msLK/OODhaQ/+US7GSJNDHJg==",
+      "version": "15.0.11",
+      "resolved": "https://registry.npmjs.org/expo-web-browser/-/expo-web-browser-15.0.11.tgz",
+      "integrity": "sha512-r2LS4Ro6DgUPZkcaEfgt8mp9eJuoA93x11Jh7S6utFe0FEzvUNn2yFhxg8XVwESaaHGt2k5V8LuK36rsp0BeIw==",
      "license": "MIT",
      "peerDependencies": {
        "expo": "*",
@ -6316,9 +6314,9 @@
      }
    },
    "node_modules/expo/node_modules/@expo/cli": {
-      "version": "54.0.23",
-      "resolved": "https://registry.npmjs.org/@expo/cli/-/cli-54.0.23.tgz",
-      "integrity": "sha512-km0h72SFfQCmVycH/JtPFTVy69w6Lx1cHNDmfLfQqgKFYeeHTjx7LVDP4POHCtNxFP2UeRazrygJhlh4zz498g==",
+      "version": "54.0.24",
+      "resolved": "https://registry.npmjs.org/@expo/cli/-/cli-54.0.24.tgz",
+      "integrity": "sha512-5xse1bEgnVUBhOrtttc6xTNJVvjyTRavpzuF0/0nuj+312vfSbk7EiRbG+xJ2pW/iZxnhLPJkFCrPYG0nmheAQ==",
      "license": "MIT",
      "dependencies": {
        "@0no-co/graphql.web": "^1.0.8",
@ -6330,7 +6328,7 @@
        "@expo/image-utils": "^0.8.8",
        "@expo/json-file": "^10.0.8",
        "@expo/metro": "~54.2.0",
-        "@expo/metro-config": "~54.0.14",
+        "@expo/metro-config": "~54.0.15",
        "@expo/osascript": "^2.3.8",
        "@expo/package-manager": "^1.9.10",
        "@expo/plist": "^0.4.8",
@ -6353,16 +6351,16 @@
        "connect": "^3.7.0",
        "debug": "^4.3.4",
        "env-editor": "^0.4.1",
-        "expo-server": "^1.0.5",
+        "expo-server": "^1.0.6",
        "freeport-async": "^2.0.0",
        "getenv": "^2.0.0",
        "glob": "^13.0.0",
-        "lan-network": "^0.1.6",
+        "lan-network": "^0.2.1",
        "minimatch": "^9.0.0",
        "node-forge": "^1.3.3",
        "npm-package-arg": "^11.0.0",
        "ora": "^3.4.0",
-        "picomatch": "^3.0.1",
+        "picomatch": "^4.0.3",
        "pretty-bytes": "^5.6.0",
        "pretty-format": "^29.7.0",
        "progress": "^2.0.3",
@ -6402,6 +6400,15 @@
        }
      }
    },
+    "node_modules/expo/node_modules/brace-expansion": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
    "node_modules/expo/node_modules/ci-info": {
      "version": "3.9.0",
      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
@ -6417,22 +6424,37 @@
        "node": ">=8"
      }
    },
+    "node_modules/expo/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
    "node_modules/expo/node_modules/picomatch": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-3.0.2.tgz",
-      "integrity": "sha512-cfDHL6LStTEKlNilboNtobT/kEa30PtAf2Q1OgszfrG/rpVl1xaFWT9ktfkS306GmHgmnad1Sw4wabhlvFtsTw==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
      "license": "MIT",
      "engines": {
-        "node": ">=10"
+        "node": ">=12"
      },
      "funding": {
        "url": "https://github.com/sponsors/jonschlinkert"
      }
    },
    "node_modules/expo/node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
@ -6442,9 +6464,9 @@
      }
    },
    "node_modules/expo/node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
+      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
@ -6845,42 +6867,6 @@
        "node": ">=10.13.0"
      }
    },
-    "node_modules/glob/node_modules/balanced-match": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.3.tgz",
-      "integrity": "sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==",
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/glob/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
    "node_modules/global-dirs": {
      "version": "0.1.1",
      "resolved": "https://registry.npmjs.org/global-dirs/-/global-dirs-0.1.1.tgz",
@ -7757,9 +7743,9 @@
      }
    },
    "node_modules/lan-network": {
-      "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/lan-network/-/lan-network-0.1.7.tgz",
-      "integrity": "sha512-mnIlAEMu4OyEvUNdzco9xpuB9YVcPkQec+QsgycBCtPZvEqWPCDPfbAE4OJMdBBWpZWtpCn1xw9jJYlwjWI5zQ==",
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/lan-network/-/lan-network-0.2.1.tgz",
+      "integrity": "sha512-ONPnazC96VKDntab9j9JKwIWhZ4ZUceB4A9Epu4Ssg0hYFmtHZSeQ+n15nIwTFmcBUKtExOer8WTJ4GF9MO64A==",
      "license": "MIT",
      "bin": {
        "lan-network": "dist/lan-network-cli.js"
@ -7800,9 +7786,9 @@
      "license": "MIT"
    },
    "node_modules/lightningcss": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
-      "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
      "license": "MPL-2.0",
      "dependencies": {
        "detect-libc": "^2.0.3"
@ -7815,23 +7801,23 @@
        "url": "https://opencollective.com/parcel"
      },
      "optionalDependencies": {
-        "lightningcss-android-arm64": "1.31.1",
-        "lightningcss-darwin-arm64": "1.31.1",
-        "lightningcss-darwin-x64": "1.31.1",
-        "lightningcss-freebsd-x64": "1.31.1",
-        "lightningcss-linux-arm-gnueabihf": "1.31.1",
-        "lightningcss-linux-arm64-gnu": "1.31.1",
-        "lightningcss-linux-arm64-musl": "1.31.1",
-        "lightningcss-linux-x64-gnu": "1.31.1",
-        "lightningcss-linux-x64-musl": "1.31.1",
-        "lightningcss-win32-arm64-msvc": "1.31.1",
-        "lightningcss-win32-x64-msvc": "1.31.1"
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
      }
    },
    "node_modules/lightningcss-android-arm64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz",
-      "integrity": "sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
      "cpu": [
        "arm64"
      ],
@ -7849,9 +7835,9 @@
      }
    },
    "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.31.1.tgz",
-      "integrity": "sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
      "cpu": [
        "arm64"
      ],
@ -7869,9 +7855,9 @@
      }
    },
    "node_modules/lightningcss-darwin-x64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.31.1.tgz",
-      "integrity": "sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
      "cpu": [
        "x64"
      ],
@ -7889,9 +7875,9 @@
      }
    },
    "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.31.1.tgz",
-      "integrity": "sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
      "cpu": [
        "x64"
      ],
@ -7909,9 +7895,9 @@
      }
    },
    "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.31.1.tgz",
-      "integrity": "sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
      "cpu": [
        "arm"
      ],
@ -7929,9 +7915,9 @@
      }
    },
    "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.31.1.tgz",
-      "integrity": "sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
      "cpu": [
        "arm64"
      ],
@ -7949,9 +7935,9 @@
      }
    },
    "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.31.1.tgz",
-      "integrity": "sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
      "cpu": [
        "arm64"
      ],
@ -7969,9 +7955,9 @@
      }
    },
    "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.31.1.tgz",
-      "integrity": "sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
      "cpu": [
        "x64"
      ],
@ -7989,9 +7975,9 @@
      }
    },
    "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.31.1.tgz",
-      "integrity": "sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
      "cpu": [
        "x64"
      ],
@ -8009,9 +7995,9 @@
      }
    },
    "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.31.1.tgz",
-      "integrity": "sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
      "cpu": [
        "arm64"
      ],
@ -8029,9 +8015,9 @@
      }
    },
    "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.31.1.tgz",
-      "integrity": "sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
      "cpu": [
        "x64"
      ],
@ -8653,15 +8639,15 @@
      }
    },
    "node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
-      "license": "ISC",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "brace-expansion": "^5.0.5"
      },
      "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
      },
      "funding": {
        "url": "https://github.com/sponsors/isaacs"
@ -8854,9 +8840,9 @@
      }
    },
    "node_modules/npm-package-arg/node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
@ -9333,9 +9319,9 @@
      }
    },
    "node_modules/postcss": {
-      "version": "8.4.49",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.49.tgz",
-      "integrity": "sha512-OCVPnIObs4N29kxTjzLfUryOkvZEq+pf8jTF0lg8E7uETuWHA+v7j3c/xJmiqpX450191LlmZfUKkXxkTry7nA==",
+      "version": "8.5.12",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
      "funding": [
        {
          "type": "opencollective",
@ -9352,7 +9338,7 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "nanoid": "^3.3.7",
+        "nanoid": "^3.3.11",
        "picocolors": "^1.1.1",
        "source-map-js": "^1.2.1"
      },
@ -11372,9 +11358,9 @@
      }
    },
    "node_modules/tar": {
-      "version": "7.5.13",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
-      "integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
+      "version": "7.5.15",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
+      "integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
        "@isaacs/fs-minipass": "^4.0.0",
@ -11678,9 +11664,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "6.24.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
-      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "version": "6.25.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz",
+      "integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==",
      "license": "MIT",
      "engines": {
        "node": ">=18.17"
@ -11873,12 +11859,16 @@
      }
    },
    "node_modules/uuid": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-7.0.3.tgz",
-      "integrity": "sha512-DPSke0pXhTZgoF/d+WSt2QaKMCFSfx7QegxEWT+JOuHF5aWrKEn0G+ztjuJg/gG8/ItK+rbPCD/yNv8yyih6Cg==",
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
      "license": "MIT",
      "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist/esm/bin/uuid"
      }
    },
    "node_modules/validate-npm-package-name": {
@ -12210,9 +12200,9 @@
      }
    },
    "node_modules/wonka": {
-      "version": "6.3.5",
-      "resolved": "https://registry.npmjs.org/wonka/-/wonka-6.3.5.tgz",
-      "integrity": "sha512-SSil+ecw6B4/Dm7Pf2sAshKQ5hWFvfyGlfPbEd6A14dOH6VDjrmbY86u6nZvy9omGwwIPFR8V41+of1EezgoUw==",
+      "version": "6.3.6",
+      "resolved": "https://registry.npmjs.org/wonka/-/wonka-6.3.6.tgz",
+      "integrity": "sha512-MXH+6mDHAZ2GuMpgKS055FR6v0xVP3XwquxIMYXgiW+FejHQlMGlvVRZT4qMCxR+bEo/FCtIdKxwej9WV3YQag==",
      "license": "MIT"
    },
    "node_modules/wrap-ansi": {
--- a/package.json
+++ b/package.json
@ -1,9 +1,10 @@
 {
  "name": "simpl-liste",
  "main": "index.js",
-  "version": "1.6.1",
+  "version": "1.6.4",
  "scripts": {
    "start": "expo start",
+    "test": "node tests/smoke.test.cjs",
    "android": "expo start --android",
    "ios": "expo start --ios",
    "web": "expo start --web"
@ -18,25 +19,25 @@
    "@react-navigation/native": "^7.1.8",
    "date-fns": "^4.1.0",
    "drizzle-orm": "^0.45.2",
-    "expo": "~54.0.33",
-    "expo-auth-session": "~7.0.10",
+    "expo": "~54.0.34",
+    "expo-auth-session": "~7.0.11",
    "expo-calendar": "~15.0.8",
    "expo-constants": "~18.0.13",
-    "expo-crypto": "~15.0.8",
+    "expo-crypto": "~15.0.9",
    "expo-file-system": "~19.0.21",
    "expo-font": "~14.0.11",
    "expo-haptics": "~15.0.8",
    "expo-intent-launcher": "~13.0.8",
-    "expo-linking": "~8.0.11",
+    "expo-linking": "~8.0.12",
    "expo-localization": "~17.0.8",
-    "expo-notifications": "~0.32.16",
+    "expo-notifications": "~0.32.17",
    "expo-router": "~6.0.23",
    "expo-secure-store": "~15.0.8",
    "expo-sharing": "~14.0.8",
    "expo-splash-screen": "~31.0.13",
    "expo-sqlite": "~16.0.10",
    "expo-status-bar": "~3.0.9",
-    "expo-web-browser": "~15.0.10",
+    "expo-web-browser": "~15.0.11",
    "i18next": "^25.8.13",
    "lucide-react-native": "^0.575.0",
    "nativewind": "^4.2.2",
@ -64,7 +65,10 @@
    "typescript": "~5.9.2"
  },
  "overrides": {
-    "esbuild": "^0.25.0"
+    "esbuild": "^0.25.0",
+    "@xmldom/xmldom": "^0.8.13",
+    "uuid": "^11.1.1",
+    "postcss": "^8.5.10"
  },
  "private": true
 }
--- a/tests/smoke.test.cjs
+++ b/tests/smoke.test.cjs
@ -0,0 +1,85 @@
+'use strict';
+
+// Non-regression smoke tests for npm overrides + deps integrity.
+// Runs on plain node (no jest, no Expo runtime). Catches the obvious
+// breakage paths after `npm install` rewrites lock for an `overrides` bump.
+//
+//   node tests/smoke.test.cjs
+//
+// Exit 0 if all checks pass, 1 if any fails.
+
+const assert = require('node:assert').strict;
+
+let failed = 0;
+function check(name, fn) {
+  try {
+    fn();
+    console.log(`OK   ${name}`);
+  } catch (e) {
+    failed++;
+    console.error(`FAIL ${name}: ${e.message}`);
+  }
+}
+
+const UUID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const NAMESPACE = '6ba7b810-9dad-11d1-80b4-00c04fd430c8';
+
+check('package.json is valid JSON with name + deps', () => {
+  const pkg = require('../package.json');
+  assert.ok(pkg.name, 'package.json missing name');
+  assert.ok(pkg.dependencies, 'package.json missing dependencies');
+});
+
+check('uuid v4 generates well-formed UUID', () => {
+  const { v4 } = require('uuid');
+  for (let i = 0; i < 5; i++) {
+    assert.match(v4(), UUID_RE);
+  }
+});
+
+// The uuid <14.0.0 advisory (GHSA-w5hq-g745-h8pq) is specifically about
+// missing buffer bounds checks in v3/v5/v6. After bumping to v14, these
+// must still produce valid UUIDs from a name + namespace.
+check('uuid v3 with namespace produces valid UUID', () => {
+  const { v3 } = require('uuid');
+  const id = v3('test-name', NAMESPACE);
+  assert.match(id, UUID_RE);
+});
+
+check('uuid v5 with namespace produces valid UUID', () => {
+  const { v5 } = require('uuid');
+  const id = v5('test-name', NAMESPACE);
+  assert.match(id, UUID_RE);
+});
+
+// Buffer-arg path is the actual vuln site — must not throw and must
+// fill the buffer with the UUID bytes.
+check('uuid v3 with buffer arg fills buffer (vuln site)', () => {
+  const { v3 } = require('uuid');
+  const buf = Buffer.alloc(16);
+  v3('test-name', NAMESPACE, buf);
+  // After the call, buf must have at least one non-zero byte.
+  assert.ok(
+    buf.some((b) => b !== 0),
+    'buffer was not filled by uuid v3'
+  );
+});
+
+check('uuid v5 with buffer arg fills buffer (vuln site)', () => {
+  const { v5 } = require('uuid');
+  const buf = Buffer.alloc(16);
+  v5('test-name', NAMESPACE, buf);
+  assert.ok(
+    buf.some((b) => b !== 0),
+    'buffer was not filled by uuid v5'
+  );
+});
+
+if (failed === 0) {
+  console.log('\nsmoke OK');
+  process.exit(0);
+} else {
+  console.error(`\nsmoke FAIL (${failed} failure${failed > 1 ? 's' : ''})`);
+  process.exit(1);
+}
Author	SHA1	Message	Date
le king fu	d38ddab0f0	chore: bump version to 1.6.4 (versionCode 16) Includes Expo SDK 54 patch alignment from #87. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-10 14:48:46 -04:00
le king fu	8ee9f9918e	state: sync after #87	2026-05-10 13:42:25 -04:00
maximus	2eed0415b9	Merge pull request 'chore(deps): align Expo SDK 54 patches' (#88 ) from issue-87-align-expo-sdk-patches into master	2026-05-10 17:41:42 +00:00
le king fu	ea4a516174	chore(deps): align Expo SDK 54 patches via expo install --fix Bumps 6 patch versions inside SDK 54 lockstep: - expo 54.0.33 -> 54.0.34 - expo-auth-session 7.0.10 -> 7.0.11 - expo-crypto 15.0.8 -> 15.0.9 - expo-linking 8.0.11 -> 8.0.12 - expo-notifications 0.32.16 -> 0.32.17 - expo-web-browser 15.0.10 -> 15.0.11 expo-doctor: 17/17 checks pass. Smoke test (tests/smoke.test.cjs): 6/6 OK. Closes #87 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-09 08:28:06 -04:00
le king fu	297acac768	state: sync after #81	2026-05-07 21:36:50 -04:00
le king fu	1d7388f9ff	chore: bump version to 1.6.3 (versionCode 15) Includes uuid override fix for GHSA-w5hq-g745-h8pq. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-05 21:37:13 -04:00
le king fu	70211fcad7	fix(security): bump uuid override to ^11.1.1 to close GHSA-w5hq-g745-h8pq The previous override ^11.0.0 allowed the vulnerable range 11.0.0 - 11.1.0. npm resolved on 11.1.0, leaving the buffer-bounds-check CVE active in v3/v5/v6 with buf arg. Bumping to ^11.1.1 stays in the 11.x major (CJS compat preserved per past revert at `800f777`) and fixes the advisory. npm audit: 0 vulnerabilities. smoke tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-05 21:35:46 -04:00
maximus	097d3f2d35	test(smoke): add non-regression smoke for uuid + package overrides (#84 )	2026-05-02 15:59:29 +00:00
le king fu	cfedde0fa6	test(smoke): add non-regression smoke for uuid + package overrides Plain-node script invoked via `npm test`. Catches the buffer-bounds regression area from GHSA-w5hq-g745-h8pq (uuid v3/v5 with buffer arg) and validates package.json structure. No jest/Expo runtime needed — runs in seconds, suitable for the defenseur-auto chain to gate auto-PRs.	2026-05-02 11:49:13 -04:00
le king fu	54ed29c50f	docs(eas-build): document APK upload retry pattern for transient 502/504 Captures lesson from v1.6.2 release: when curl reports HTTP 502/504 ~60s into the upload of a 90+ MB APK, the cause is client-side bandwidth dropping under ~1.5 MB/s, not Traefik or Forgejo config. Retry — bandwidth recovers. Adds: retry loop, diagnostics checklist, correct DELETE asset path (/releases/{release_id}/assets/{asset_id}, not /releases/assets/{asset_id}). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-01 07:17:51 -04:00
le king fu	22f96bc9a9	chore: bump version to 1.6.2 (versionCode 14) Security release: 5 CVE resolved in build-time dep chain via overrides (@xmldom/xmldom, uuid, postcss). 4 HIGH + 1 MEDIUM cleared. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-28 19:48:49 -04:00
maximus	2245484407	Merge pull request 'fix(security): override postcss to ^8.5.10' (#80 ) from fix/vuln-postcss-override into master	2026-04-28 01:26:11 +00:00
le king fu	08cba37775	fix(security): override postcss to ^8.5.10 Resolves GHSA-qx2v-qp2m-jg93 (PostCSS XSS via Unescaped </style> in CSS Stringify Output) in the @expo/metro-config + tailwindcss build chain. Build-time only, not runtime-exploitable in RN, but cleared for audit hygiene. Defenseur scan post-override: 13/13 passed, 0 findings (the residual uuid cascade is suppressed via defenseurs allowlist for GHSA-w5hq-g745-h8pq). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-26 15:37:19 -04:00
maximus	cc1e187c85	Merge pull request 'verify(security): seed STATE+SECURITY + defenseur rescan (#76 )' (#79 ) from fix/vuln-C-verification into master	2026-04-24 18:14:34 +00:00
maximus	ced900b191	Merge pull request 'fix(security): override uuid to ^11.0.0 (#75 )' (#78 ) from fix/vuln-B-uuid-override into master	2026-04-24 18:14:25 +00:00
maximus	dfe5214b57	Merge pull request 'fix(security): override @xmldom/xmldom to ^0.8.13 (#74 )' (#77 ) from fix/vuln-A-xmldom-override into master	2026-04-24 18:13:56 +00:00
le king fu	f52e1e9e06	docs(security): seed STATE.md and SECURITY.md after vuln remediation STATE.md follows the 3-section monorepo pattern (Position actuelle, Decisions recentes, Blockers actifs). SECURITY.md tracks resolved CVE (4 HIGH xmldom) and residuals (GHSA-w5hq-g745-h8pq uuid, non-exploitable in practice). Refs #76 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-24 07:30:41 -04:00
le king fu	ed4c10f29c	fix(security): override uuid to ^11.0.0 Resolves GHSA-w5hq-g745-h8pq in the transitive chain (xcode + @expo/ngrok). Per spec decision D3, we pin ^11.0.0 (not ^14.0.0) to avoid ESM-only breaking CJS consumers. Actual vulnerable code paths (v3/v5/v6 with buf param) are not used by xcode or @expo/ngrok — they only call uuid.v4() — so the override is safe in practice even though npm advisory range is <14.0.0. Refs #75 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-24 07:16:35 -04:00
le king fu	5842a686b2	fix(security): override @xmldom/xmldom to ^0.8.13 Resolves 4 HIGH CVE in the xmldom transitive dep chain (Expo CLI + xcode/plist). Not runtime-exploitable in APK (build-time deps only) but cleaned for audit hygiene. - GHSA-2v35-w6hq-6mfw (DoS — uncontrolled recursion in XML serialization) - GHSA-f6ww-3ggp-fr8h (XML injection via DOCTYPE serialization) - GHSA-x6wf-f3px-wcqx (XML injection via processing instruction serialization) - GHSA-j759-j44w-7fr8 (XML injection via comment serialization) Refs #74 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-24 07:13:40 -04:00
maximus	8a0cc97018	Merge PR #73 — fix: widget render-optimiste (#71 )	2026-04-19 20:24:18 +00:00