state: sync after #133, #134, #135 (PR #138)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -40,3 +40,9 @@ yarn-error.*
 # generated native folders
 /ios
 /android
+
+# Next.js build output (web companion)
+/.next/
+
+# autopilot daily reports
+/reports/

STATE.md

@@ -1,13 +1,34 @@
 # STATE — simpl-liste
 
-> Derniere MAJ : 2026-05-30 (deploy web liste.lacompagnie + #90)
+> Derniere MAJ : 2026-10-06 (par fix-issue #133, #134, #135 — PR #138)
 
 ## Position actuelle
 
-Version 1.6.4 (versionCode 16). Remediation vulnerabilites du defenseur en cours
-via overrides `@xmldom/xmldom@^0.8.13` et `uuid@^11.0.0` dans `package.json`
-(overnight 2026-04-24). 4 CVE HIGH xmldom nettoyees ; 1 advisory uuid residuelle
-non-exploitable en pratique (details dans `SECURITY.md`).
+Version 1.6.6 (versionCode 18). `npm audit` = 40 entrees (0 critical) au 2026-10-06 apres
+PR #138, pour 5 advisories sans correctif publie (le reste est de la cascade de parents) :
+`braces` (high, #130), `node-forge` (high, #123), `postcss-selector-parser` GHSA-rj75
+(moderate, #136, sortie = tailwind 4), `sprintf-js` (moderate, #137) et la chaine
+`expo-router` -> `query-string@7` -> `decode-uri-component` (risque accepte #120). Toutes
+sont de l'outillage de build/dev : rien dans l'APK.
+
+La remediation passe par des overrides de plancher dans `package.json` :
+`esbuild`, `@xmldom/xmldom@^0.8.15`, `uuid`, `postcss`, `js-yaml` (3.15.2 / 4.3.2), `brace-expansion` (1.1.21 / 2.1.7 / 5.0.12),
+`@babel/core`, `browserslist@^4.28.7`, `@react-navigation/core@^7.22.1`,
+`http-cache-semantics@^4` (4.3.0), `postcss-selector-parser@^6` (6.1.3), `source-map-js@^1` (1.2.2),
+`react-devtools-core > shell-quote` (^1.11.0), `@expo/cli > compression` (^1.8.2), et les 14
+paquets `metro@^0.83.8`. Le smoke test verrouille la chaine de build (presets Expo
+hoistes a la racine, un seul SDK Expo, metro 0.83.x partout) et les planchers
+`brace-expansion` / `undici` / `http-cache-semantics` / `postcss-selector-parser` /
+`shell-quote` / `compression` / `source-map-js` (plancher + appel de l'API consommee) /
+comportement de `minimatch` (majeurs 3, 9, 10).
+
+**Caveat sur l'override metro** (releve par la review de PR #114) : `0.83.3 -> 0.83.8`
+n'est pas un bump de patch pur cote API privee. Trois shims de `@expo/metro@54.2.0`,
+ecrit contre 0.83.3, ne resolvent plus — `metro-resolver/utils/toPosixPath` et
+`metro/node-haste/Package` supprimes, `metro-file-map/lib/dependencyExtractor` deplace.
+Ils leveraient `MODULE_NOT_FOUND`, mais **aucun paquet de l'arbre ne les requiert**
+(203 des 206 imports profonds `metro*/private/...` resolvent). Inerte aujourd'hui ;
+a re-verifier au prochain bump du SDK Expo ou de `@expo/metro`.
 
 Companion web `liste.lacompagniemaximus.com` : deploye **manuellement** (docker-compose
 standalone `/data/simpl-liste-web` sur le VPS, build depuis `source/` rsync — PAS une app
@@ -15,15 +36,21 @@ Coolify malgre la spec). Procedure en memoire `simpl-liste-web-deploy`.
 
 ## Decisions recentes
 
-- 2026-05-30 : #90 merged (PR #93, ThemeToggle eslint-disable) + premier deploy web depuis 7 sem (rsync source/ + docker compose --build sur VPS) — #70 et #90 live sur liste.lacompagniemaximus.com.
-- 2026-05-30 : PR #89 merged — display name web resolu via userInfo (ordre fallback de la vitrine), fix #70.
-- 2026-05-30 : nettoyage lint web/ (PR #91, 2 prefer-const + import inutilise) ; #90 analyse (ThemeToggle set-state-in-effect, decision : eslint-disable documente).
-- 2026-05-10 : Aligne 6 patches Expo SDK 54 via expo install --fix — expo-doctor 17/17 (ref #87)
-- 2026-05-08 : Defenseur rerun confirme 0 findings — overrides existants suffisent, pas de PR necessaire (ref #81)
-- 2026-04-24 : overrides xmldom + uuid (spec `spec-decisions-vuln-simpl-liste.md`) — PRs #77, #78, #79 (pending-human).
-- 2026-04-23 : PR #71 merged — fix widget render-optimiste + timing instrumentation.
-- 2026-04-18 : archive milestone `spec-simpl-liste-web` (12/12 done).
+- 2026-10-06 : #133, #134, #135 fermees (PR #138 merged) — `shell-quote` ^1.11.0 (CRITICAL GHSA-pqg4, releve le plancher de #95), `@expo/cli > compression` ^1.8.2 (HIGH), `source-map-js@^1.0.0` ^1.2.2 (HIGH, pipeline CSS). `npm audit` 43 -> 40, critical 0. Export identique octet pour octet (44 fichiers), serveur de dev sert le bundle en gzip. Ouvertes le meme jour en plancher : #136 (`postcss-selector-parser` GHSA-rj75, aucun correctif 6.x) et #137 (`sprintf-js`, tete publiee vulnerable). `/analyse-vulnerabilite` cherche desormais les antecedents fermes avant de proposer.
+- 2026-10-05 : #128 et #129 fermees (PR #131 merged) — planchers version-scoped `http-cache-semantics@^4.0.0` -> ^4.3.0 (GHSA-ch52 high : l'advisory ne liste aucun patch, mais 4.3.0 sort de la borne `<=4.2.0` ; tunnel `@expo/ngrok` seulement) et `postcss-selector-parser@^6.0.0` -> ^6.1.3 (low, pipeline tailwind). `npm audit` 33 -> 31. Preuve du livrable : bundle JS (`expo export --no-bytecode --clear`) identique octet pour octet. **Le hash `.hbc` n'est pas une preuve** : Hermes n'est pas deterministe ici (deux exports du meme arbre different).
+- 2026-10-05 : #126 fermee, acceptation de #120 maintenue — `decode-uri-component@0.5.0` est ESM pur, `query-string@7` le `require()`. Declencheur de sortie : `expo-router@58.0.13` (SDK 58) retire `query-string`, pas encore backporte sur sdk-54..57. #130 ouverte : `braces` plancher (3.0.3 = tete publiee, vulnerable).
+- 2026-10-02 : #124 et #125 fermees (PR #127 merged) — planchers `brace-expansion` ^1.1.21 / ^2.1.7 / ^5.0.12 (9 advisories DoS neuves, toujours version-scoped) et `@expo/cli > undici` ^6.28.1 (resolu 6.29.0). Outillage de build seulement. Trois gardes au smoke test, dont le test `minimatch` qui manquait depuis #103. `npm audit` 12 -> 10. Ouvertes le meme jour : #123 (`node-forge`, tete publiee 1.4.0 vulnerable) et #126 (`decode-uri-component@0.5.0` publiee).
+- 2026-09-27 : #120 fermee en risque accepte (rectification du cadrage « attend un bump de SDK »). Aucune version d'expo-router (jusqu'a 58.0.8 / sdk-57) ne quitte `query-string@7`. expo-router n'appelle que `queryString.stringify()`, qui ne touche jamais `decode-uri-component` (le seul `parse()` du fork est commente) : code vulnerable inatteignable. A re-verifier a chaque bump d'expo-router.
+- 2026-09-25 : #121 fermee (PR #122 merged) — planchers `@xmldom/xmldom@^0.8.15` et `js-yaml` ^3.15.2 / ^4.3.2 (advisories HIGH du 2026-09-08, outillage de build seulement, hash du bundle Hermes inchange). Le Defenseur ne les avait pas signalees : hypothese de dedup par paquet contre issues fermees -> agent-defenseurs#139.
+- 2026-09-25 : #117 fermee (PR #119 merged) — override `@react-navigation/core@^7.22.1`, qui ne depend plus de `query-string` (GHSA-vcc3-ghjq-m6fr). Lock : 2 entrees. PR #118 du Defenseur fermee : son `npm audit fix` global desinstallait `babel-preset-expo`/`@expo/metro-config` de la racine et nichait un Expo 57 (build casse, tests verts). Gardes de toolchain ajoutees au smoke test. Residu `expo-router` -> #120.
+- 2026-09-04 : #115 ouverte + PR #116 — `browserslist@^4.28.7` (2 advisories HIGH publiees le 2026-09-01, `first_patched_version = 4.28.7`). Resout en 4.28.9, derniere HIGH de l'arbre. Bundle Hermes au hash identique avant/apres : cibles de compilation inchangees.
+- 2026-09-04 : #112 fermee doublon de #108 ; PR #113 fermee sans merge (son diff ne contenait aucune occurrence d'`image-size` — 633/584 de churn de lockfile sans rapport).
+- 2026-09-04 : #108 fermee (PR #114 merged) — `image-size` retiree de l'arbre via overrides `metro@^0.83.8`. Le blocage upstream tient toujours (`first_patched_version = None`, `2.0.2` reste la derniere publiee) ; c'est metro qui a **supprime** la dependance et vendore un parseur reduit sans les formats ICNS/JXL/HEIF vises. Backport sur la ligne 0.83.x le 2026-08-19 — pas besoin du bump de SDK Expo anticipe. 9 HIGH -> 1 HIGH.
 
 ## Blockers actifs
 
-Aucun.
+- Essai sur appareil a faire avant le prochain APK : core 7.22.1 tourne avec native/native-stack/bottom-tabs publies contre 7.14 (deep link vers une tache, onglets, pile).
+- #130 : `braces` <=3.0.3 sans version corrigee. Surveiller `braces` > 3.0.3 ou `micromatch` qui la largue.
+- #123 : `node-forge` <=1.4.0 sans version corrigee. Surveiller `node-forge` > 1.4.0 ou le retrait de la dependance par `@expo/code-signing-certificates` / `@expo/cli`.
+- #136 : `postcss-selector-parser` GHSA-rj75 sans correctif 6.x. Surveiller un backport 6.x ou la migration NativeWind 5 / tailwind 4.
+- #137 : `sprintf-js` <=1.1.3 sans version corrigee. Surveiller une version hors borne ou une `@istanbuljs/load-nyc-config` 2.x.

app.json

@@ -2,7 +2,7 @@
   "expo": {
     "name": "Simpl-Liste",
     "slug": "simpl-liste",
-    "version": "1.6.5",
+    "version": "1.6.6",
     "orientation": "portrait",
     "icon": "./assets/images/icon.png",
     "scheme": "simplliste",
@@ -24,7 +24,7 @@
         "backgroundColor": "#FFF8F0"
       },
       "edgeToEdgeEnabled": true,
-      "versionCode": 17
+      "versionCode": 18
     },
     "plugins": [
       "expo-router",

app/(tabs)/settings.tsx

@@ -2,7 +2,7 @@ import { useState, useEffect, useCallback } from 'react';
 import { View, Text, Pressable, useColorScheme, TextInput, ScrollView, Alert, Modal, Platform, Switch, Linking, ActivityIndicator } from 'react-native';
 import { KeyboardAvoidingView } from 'react-native-keyboard-controller';
 import { useTranslation } from 'react-i18next';
-import { Sun, Moon, Smartphone, Plus, Trash2, Pencil, Bell, CalendarDays, LayoutGrid, Mail, RefreshCw, Cloud, LogIn, LogOut } from 'lucide-react-native';
+import { Sun, Moon, Smartphone, Plus, Trash2, Pencil, Bell, CalendarDays, LayoutGrid, Mail, RefreshCw, Cloud, LogIn, LogOut, MessageSquarePlus } from 'lucide-react-native';
 import Constants from 'expo-constants';
 
 import { useLogto } from '@logto/rn';
@@ -14,6 +14,7 @@ import { initCalendar } from '@/src/services/calendar';
 import { syncWidgetData } from '@/src/services/widgetSync';
 import { fullSync, initialMerge, initialReset } from '@/src/services/syncClient';
 import i18n from '@/src/i18n';
+import FeedbackModal from '@/src/components/FeedbackModal';
 
 type ThemeMode = 'light' | 'dark' | 'system';
 
@@ -40,6 +41,7 @@ export default function SettingsScreen() {
   const [tagName, setTagName] = useState('');
   const [tagColor, setTagColor] = useState(TAG_COLORS[0]);
   const [checkingUpdate, setCheckingUpdate] = useState(false);
+  const [showFeedback, setShowFeedback] = useState(false);
   const [isSyncing, setIsSyncing] = useState(false);
   const { signIn: logtoSignIn, signOut: logtoSignOut, getIdTokenClaims, isAuthenticated } = useLogto();
 
@@ -694,6 +696,12 @@ export default function SettingsScreen() {
         </KeyboardAvoidingView>
       </Modal>
 
+      <FeedbackModal
+        visible={showFeedback}
+        onClose={() => setShowFeedback(false)}
+        isDark={isDark}
+      />
+
       {/* About Section */}
       <View className="px-4 pb-8 pt-6">
         <Text
@@ -728,6 +736,18 @@ export default function SettingsScreen() {
               {t('settings.checkUpdate')}
             </Text>
           </Pressable>
+          <Pressable
+            onPress={() => setShowFeedback(true)}
+            className={`flex-row items-center border-b px-4 py-3.5 ${isDark ? 'border-[#3A3A3A]' : 'border-[#E5E7EB]'}`}
+          >
+            <MessageSquarePlus size={20} color={isDark ? '#A0A0A0' : '#6B6B6B'} />
+            <Text
+              className={`ml-3 text-base ${isDark ? 'text-[#F5F5F5]' : 'text-[#1A1A1A]'}`}
+              style={{ fontFamily: 'Inter_400Regular' }}
+            >
+              {t('feedback.open')}
+            </Text>
+          </Pressable>
           <Pressable
             onPress={() => Linking.openURL('mailto:lacompagniemaximus@protonmail.com')}
             className="flex-row items-center px-4 py-3.5"

package.json

@@ -1,10 +1,10 @@
 {
   "name": "simpl-liste",
   "main": "index.js",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "scripts": {
     "start": "expo start",
-    "test": "node tests/smoke.test.cjs",
+    "test": "node tests/smoke.test.cjs && node --test --disable-warning=ExperimentalWarning --disable-warning=MODULE_TYPELESS_PACKAGE_JSON tests/feedback.test.mjs",
     "android": "expo start --android",
     "ios": "expo start --ios",
     "web": "expo start --web",
@@ -68,16 +68,27 @@
   },
   "overrides": {
     "esbuild": "^0.25.0",
-    "@xmldom/xmldom": "^0.8.13",
+    "@xmldom/xmldom": "^0.8.15",
     "uuid": "^11.1.1",
-    "postcss": "^8.5.10",
+    "postcss": "^8.5.18",
+    "postcss-selector-parser@^6.0.0": "^6.1.3",
+    "source-map-js@^1.0.0": "^1.2.2",
+    "http-cache-semantics@^4.0.0": "^4.3.0",
+    "js-yaml@^3.0.0": "^3.15.2",
+    "js-yaml@^4.0.0": "^4.3.2",
+    "brace-expansion@^1.0.0": "^1.1.21",
+    "brace-expansion@^2.0.0": "^2.1.7",
+    "brace-expansion@^5.0.0": "^5.0.12",
+    "@babel/core": "^7.29.6",
+    "browserslist": "^4.28.7",
     "@expo/cli": {
+      "compression": "^1.8.2",
       "ws": "^8.20.1",
-      "undici": "^6.27.0",
-      "tar": "^7.5.19"
+      "undici": "^6.28.1",
+      "tar": "^7.5.21"
     },
     "react-devtools-core": {
-      "shell-quote": "^1.8.4",
+      "shell-quote": "^1.11.0",
       "ws": "^7.5.11"
     },
     "react-native": {
@@ -87,14 +98,23 @@
       "ws": "^7.5.11"
     },
     "metro": {
-      "ws": "^7.5.11"
+      "ws": "^7.5.11",
+      ".": "^0.83.8"
     },
-    "@expo/xcpretty": {
-      "js-yaml": "^4.2.0"
-    },
-    "@istanbuljs/load-nyc-config": {
-      "js-yaml": "^3.15.0"
-    }
+    "metro-babel-transformer": "^0.83.8",
+    "metro-cache": "^0.83.8",
+    "metro-cache-key": "^0.83.8",
+    "metro-config": "^0.83.8",
+    "metro-core": "^0.83.8",
+    "metro-file-map": "^0.83.8",
+    "metro-minify-terser": "^0.83.8",
+    "metro-resolver": "^0.83.8",
+    "metro-runtime": "^0.83.8",
+    "metro-source-map": "^0.83.8",
+    "metro-symbolicate": "^0.83.8",
+    "metro-transform-plugins": "^0.83.8",
+    "metro-transform-worker": "^0.83.8",
+    "@react-navigation/core": "^7.22.1"
   },
   "private": true
 }

src/components/FeedbackModal.tsx

@@ -0,0 +1,253 @@
+import { useEffect, useState } from 'react';
+import {
+  View,
+  Text,
+  Pressable,
+  Modal,
+  TextInput,
+  ActivityIndicator,
+  Dimensions,
+  Platform,
+} from 'react-native';
+import { KeyboardAvoidingView } from 'react-native-keyboard-controller';
+import { usePathname } from 'expo-router';
+import { useTranslation } from 'react-i18next';
+import { X, MessageSquarePlus, CheckCircle, AlertCircle, Check } from 'lucide-react-native';
+import Constants from 'expo-constants';
+
+import { colors } from '@/src/theme/colors';
+import { useSettingsStore } from '@/src/stores/useSettingsStore';
+import { useFeedback } from '@/src/hooks/useFeedback';
+import { MAX_CONTENT_LENGTH, type FeedbackContext } from '@/src/services/feedback';
+
+interface FeedbackModalProps {
+  visible: boolean;
+  onClose: () => void;
+  isDark: boolean;
+}
+
+const AUTO_CLOSE_MS = 2000;
+
+export default function FeedbackModal({ visible, onClose, isDark }: FeedbackModalProps) {
+  const { t, i18n } = useTranslation();
+  const pathname = usePathname();
+  const { userId } = useSettingsStore();
+  const { state, submit, reset } = useFeedback();
+
+  const [content, setContent] = useState('');
+  const [includeContext, setIncludeContext] = useState(false);
+  const [identify, setIdentify] = useState(false);
+
+  const trimmed = content.trim();
+  const isSending = state.status === 'sending';
+  const isSuccess = state.status === 'success';
+  const canSubmit = trimmed.length > 0 && !isSending && !isSuccess;
+
+  const textColor = isDark ? '#F5F5F5' : '#1A1A1A';
+  const mutedColor = isDark ? '#A0A0A0' : '#6B6B6B';
+  const borderColor = isDark ? '#3A3A3A' : '#E5E7EB';
+  const successColor = colors.priority.low;
+  const errorColor = colors.terracotta.DEFAULT;
+
+  // Reset both local and hook state each time the modal opens.
+  useEffect(() => {
+    if (visible) {
+      setContent('');
+      setIncludeContext(false);
+      setIdentify(false);
+      reset();
+    }
+  }, [visible, reset]);
+
+  // Auto-close after a successful send; timer cleared on unmount / state change.
+  useEffect(() => {
+    if (!isSuccess) return;
+    const timer = setTimeout(() => {
+      onClose();
+      reset();
+    }, AUTO_CLOSE_MS);
+    return () => clearTimeout(timer);
+  }, [isSuccess, onClose, reset]);
+
+  const handleClose = () => {
+    if (isSending) return;
+    onClose();
+  };
+
+  const handleSubmit = async () => {
+    if (!canSubmit) return;
+
+    let context: FeedbackContext | undefined;
+    if (includeContext) {
+      const { width, height } = Dimensions.get('window');
+      context = {
+        page: pathname,
+        locale: i18n.language,
+        theme: isDark ? 'dark' : 'light',
+        viewport: `${Math.round(width)}x${Math.round(height)}`,
+        userAgent: `Simpl-Liste/${Constants.expoConfig?.version ?? '0.0.0'} (${Platform.OS})`,
+        timestamp: new Date().toISOString(),
+      };
+    }
+
+    const feedbackUserId = identify && userId ? userId : null;
+    await submit({ content, userId: feedbackUserId, context });
+  };
+
+  const errorMessage = (() => {
+    if (state.status !== 'error' || !state.errorCode) return null;
+    switch (state.errorCode) {
+      case 'rate_limit':
+        return t('feedback.error.rateLimit');
+      case 'invalid':
+        return t('feedback.error.invalid');
+      default:
+        return t('feedback.error.generic');
+    }
+  })();
+
+  return (
+    <Modal visible={visible} transparent animationType="fade" onRequestClose={handleClose}>
+      <KeyboardAvoidingView behavior="padding" style={{ flex: 1 }}>
+        <Pressable onPress={handleClose} className="flex-1 justify-end bg-black/40">
+          <Pressable
+            onPress={(e) => e.stopPropagation()}
+            className={`rounded-t-2xl px-4 pb-8 pt-4 ${isDark ? 'bg-[#2A2A2A]' : 'bg-white'}`}
+          >
+            {/* Header */}
+            <View className="mb-4 flex-row items-center justify-between">
+              <View className="flex-row items-center">
+                <MessageSquarePlus size={20} color={colors.bleu.DEFAULT} />
+                <Text className="ml-2 text-lg" style={{ fontFamily: 'Inter_600SemiBold', color: textColor }}>
+                  {t('feedback.title')}
+                </Text>
+              </View>
+              <Pressable onPress={handleClose} disabled={isSending} className="p-1">
+                <X size={20} color={mutedColor} />
+              </Pressable>
+            </View>
+
+            {isSuccess ? (
+              <View className="items-center justify-center py-10">
+                <CheckCircle size={40} color={successColor} />
+                <Text
+                  className="mt-3 text-base"
+                  style={{ fontFamily: 'Inter_500Medium', color: textColor }}
+                >
+                  {t('feedback.success')}
+                </Text>
+              </View>
+            ) : (
+              <>
+                <TextInput
+                  value={content}
+                  onChangeText={(v) => setContent(v.slice(0, MAX_CONTENT_LENGTH))}
+                  placeholder={t('feedback.placeholder')}
+                  placeholderTextColor={mutedColor}
+                  editable={!isSending}
+                  multiline
+                  className="min-h-[120px] rounded-xl border px-3 py-2.5 text-base"
+                  style={{
+                    fontFamily: 'Inter_400Regular',
+                    color: textColor,
+                    borderColor,
+                    textAlignVertical: 'top',
+                  }}
+                />
+                <Text className="mt-1 self-end text-xs" style={{ color: mutedColor }}>
+                  {content.length}/{MAX_CONTENT_LENGTH}
+                </Text>
+
+                {/* Opt-in: navigation context */}
+                <Pressable
+                  onPress={() => setIncludeContext((v) => !v)}
+                  disabled={isSending}
+                  className="mt-3 flex-row items-center"
+                >
+                  <View
+                    className="h-5 w-5 items-center justify-center rounded border"
+                    style={{
+                      borderColor: includeContext ? colors.bleu.DEFAULT : borderColor,
+                      backgroundColor: includeContext ? colors.bleu.DEFAULT : 'transparent',
+                    }}
+                  >
+                    {includeContext && <Check size={14} color="#FFFFFF" />}
+                  </View>
+                  <Text
+                    className="ml-2 flex-1 text-sm"
+                    style={{ fontFamily: 'Inter_400Regular', color: textColor }}
+                  >
+                    {t('feedback.includeContext')}
+                  </Text>
+                </Pressable>
+
+                {/* Opt-in: identify (only when signed in) */}
+                {!!userId && (
+                  <Pressable
+                    onPress={() => setIdentify((v) => !v)}
+                    disabled={isSending}
+                    className="mt-2 flex-row items-center"
+                  >
+                    <View
+                      className="h-5 w-5 items-center justify-center rounded border"
+                      style={{
+                        borderColor: identify ? colors.bleu.DEFAULT : borderColor,
+                        backgroundColor: identify ? colors.bleu.DEFAULT : 'transparent',
+                      }}
+                    >
+                      {identify && <Check size={14} color="#FFFFFF" />}
+                    </View>
+                    <Text
+                      className="ml-2 flex-1 text-sm"
+                      style={{ fontFamily: 'Inter_400Regular', color: textColor }}
+                    >
+                      {t('feedback.identify')}
+                    </Text>
+                  </Pressable>
+                )}
+
+                {errorMessage && (
+                  <View className="mt-3 flex-row items-center">
+                    <AlertCircle size={16} color={errorColor} />
+                    <Text
+                      className="ml-2 flex-1 text-sm"
+                      style={{ fontFamily: 'Inter_400Regular', color: errorColor }}
+                    >
+                      {errorMessage}
+                    </Text>
+                  </View>
+                )}
+
+                {/* Actions */}
+                <View className="mt-5 flex-row items-center justify-end">
+                  <Pressable onPress={handleClose} disabled={isSending} className="mr-2 px-4 py-2.5">
+                    <Text
+                      className="text-sm"
+                      style={{ fontFamily: 'Inter_500Medium', color: mutedColor }}
+                    >
+                      {t('feedback.cancel')}
+                    </Text>
+                  </Pressable>
+                  <Pressable
+                    onPress={handleSubmit}
+                    disabled={!canSubmit}
+                    className="rounded-lg bg-bleu px-4 py-2.5"
+                    style={{ opacity: canSubmit ? 1 : 0.5 }}
+                  >
+                    {isSending ? (
+                      <ActivityIndicator size={18} color="#FFFFFF" />
+                    ) : (
+                      <Text className="text-sm text-white" style={{ fontFamily: 'Inter_600SemiBold' }}>
+                        {t('feedback.submit')}
+                      </Text>
+                    )}
+                  </Pressable>
+                </View>
+              </>
+            )}
+          </Pressable>
+        </Pressable>
+      </KeyboardAvoidingView>
+    </Modal>
+  );
+}

src/hooks/useFeedback.ts

@@ -0,0 +1,55 @@
+import { useCallback, useReducer } from 'react';
+
+import {
+  sendFeedback,
+  type FeedbackErrorCode,
+  type SendFeedbackInput,
+} from '@/src/services/feedback';
+
+export type FeedbackStatus = 'idle' | 'sending' | 'success' | 'error';
+
+export interface FeedbackState {
+  status: FeedbackStatus;
+  errorCode: FeedbackErrorCode | null;
+}
+
+type FeedbackAction =
+  | { type: 'SEND_START' }
+  | { type: 'SEND_SUCCESS' }
+  | { type: 'SEND_ERROR'; code: FeedbackErrorCode }
+  | { type: 'RESET' };
+
+const initialState: FeedbackState = { status: 'idle', errorCode: null };
+
+function reducer(_state: FeedbackState, action: FeedbackAction): FeedbackState {
+  switch (action.type) {
+    case 'SEND_START':
+      return { status: 'sending', errorCode: null };
+    case 'SEND_SUCCESS':
+      return { status: 'success', errorCode: null };
+    case 'SEND_ERROR':
+      return { status: 'error', errorCode: action.code };
+    case 'RESET':
+      return initialState;
+  }
+}
+
+// Feedback submission state machine (idle -> sending -> success | error).
+// The network call never throws; the outcome is derived from its result.
+export function useFeedback() {
+  const [state, dispatch] = useReducer(reducer, initialState);
+
+  const submit = useCallback(async (args: SendFeedbackInput) => {
+    dispatch({ type: 'SEND_START' });
+    const result = await sendFeedback(args);
+    if (result.ok) {
+      dispatch({ type: 'SEND_SUCCESS' });
+    } else {
+      dispatch({ type: 'SEND_ERROR', code: result.code });
+    }
+  }, []);
+
+  const reset = useCallback(() => dispatch({ type: 'RESET' }), []);
+
+  return { state, submit, reset };
+}

src/i18n/en.json

@@ -105,6 +105,21 @@
     "download": "Download",
     "updateError": "Unable to check for updates"
   },
+  "feedback": {
+    "open": "Send feedback",
+    "title": "Your feedback",
+    "placeholder": "Describe your suggestion or the issue you ran into...",
+    "cancel": "Cancel",
+    "submit": "Send",
+    "includeContext": "Include navigation context",
+    "identify": "Identify me (attach my account)",
+    "success": "Thanks for your feedback!",
+    "error": {
+      "rateLimit": "Too many submissions. Try again in a moment.",
+      "invalid": "Invalid message. Check the content.",
+      "generic": "Couldn't send. Try again later."
+    }
+  },
   "notifications": {
     "title": "Notifications",
     "enabled": "Reminders enabled",

src/i18n/fr.json

@@ -105,6 +105,21 @@
     "download": "Télécharger",
     "updateError": "Impossible de vérifier les mises à jour"
   },
+  "feedback": {
+    "open": "Envoyer un feedback",
+    "title": "Votre feedback",
+    "placeholder": "Décrivez votre suggestion ou le problème rencontré...",
+    "cancel": "Annuler",
+    "submit": "Envoyer",
+    "includeContext": "Inclure le contexte de navigation",
+    "identify": "M'identifier (joindre mon compte)",
+    "success": "Merci pour votre feedback !",
+    "error": {
+      "rateLimit": "Trop d'envois. Réessayez dans un moment.",
+      "invalid": "Message invalide. Vérifiez le contenu.",
+      "generic": "Envoi impossible. Réessayez plus tard."
+    }
+  },
   "notifications": {
     "title": "Notifications",
     "enabled": "Rappels activés",

src/services/feedback.ts

@@ -0,0 +1,100 @@
+// Feedback Hub client — posts user feedback to the centralized micro-service
+// (feedback.lacompagniemaximus.com). The endpoint is public (no auth) and
+// re-sanitizes everything server-side; the mirror logic here keeps the payload
+// minimal and predictable.
+//
+// IMPORTANT: this module is deliberately dependency-free (no RN/Expo imports,
+// no `@/` path alias, only the global `fetch`/`console`). Its pure helpers are
+// unit-tested with `node --test` via native TS type-stripping
+// (tests/feedback.test.mjs), which cannot resolve the `@/` alias. Keep it
+// import-free so that test path stays valid — the smoke test enforces this.
+
+export const FEEDBACK_HUB_URL = 'https://feedback.lacompagniemaximus.com';
+export const APP_ID = 'simpl-liste';
+export const MAX_CONTENT_LENGTH = 2000;
+const MAX_CONTEXT_VALUE_LENGTH = 500;
+
+// Strict whitelist mirrored from the server's `sanitizeContext`. Any other key
+// is dropped server-side anyway; we drop it here too.
+export const CONTEXT_KEYS = [
+  'page',
+  'locale',
+  'theme',
+  'viewport',
+  'userAgent',
+  'timestamp',
+] as const;
+
+export type FeedbackContextKey = (typeof CONTEXT_KEYS)[number];
+export type FeedbackContext = Partial<Record<FeedbackContextKey, string>>;
+
+export type FeedbackErrorCode =
+  | 'invalid'
+  | 'rate_limit'
+  | 'server_error'
+  | 'network_error';
+
+export type FeedbackResult = { ok: true } | { ok: false; code: FeedbackErrorCode };
+
+export interface SendFeedbackInput {
+  content: string;
+  userId?: string | null;
+  context?: FeedbackContext;
+}
+
+// Client-side cap on the raw text the user typed. Note: the server strips HTML
+// *then* caps at 2000, so markup-heavy input may be shortened server-side. The
+// server is authoritative; here we cap the raw string so the char counter and
+// payload stay bounded.
+export function capContent(content: string): string {
+  return content.trim().slice(0, MAX_CONTENT_LENGTH);
+}
+
+// Keep only whitelisted string keys, each truncated to 500 chars. Returns
+// undefined when nothing survives so the field is omitted from the payload.
+export function sanitizeContext(
+  raw: FeedbackContext | null | undefined,
+): FeedbackContext | undefined {
+  if (!raw) return undefined;
+  const out: FeedbackContext = {};
+  for (const key of CONTEXT_KEYS) {
+    const value = raw[key];
+    if (typeof value === 'string' && value.length > 0) {
+      out[key] = value.slice(0, MAX_CONTEXT_VALUE_LENGTH);
+    }
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+// Map a non-ok HTTP status to a stable error code. 400 = bad app_id/empty
+// content, 429 = rate limit (5/hour/IP). Anything else (403/404/413/5xx) is a
+// server_error so the UI never lands on an undefined state.
+export function resolveErrorCode(status: number): FeedbackErrorCode {
+  if (status === 400) return 'invalid';
+  if (status === 429) return 'rate_limit';
+  return 'server_error';
+}
+
+export async function sendFeedback(input: SendFeedbackInput): Promise<FeedbackResult> {
+  const context = sanitizeContext(input.context);
+  const body: Record<string, unknown> = {
+    app_id: APP_ID,
+    content: capContent(input.content),
+    user_id: input.userId ?? null,
+  };
+  if (context) body.context = context;
+
+  try {
+    const res = await fetch(`${FEEDBACK_HUB_URL}/api/feedback`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+    if (res.ok) return { ok: true };
+    console.warn(`[feedback] request failed with status ${res.status}`);
+    return { ok: false, code: resolveErrorCode(res.status) };
+  } catch (err) {
+    console.warn('[feedback] network error:', err);
+    return { ok: false, code: 'network_error' };
+  }
+}

tests/feedback.test.mjs

@@ -0,0 +1,149 @@
+// Execution tests for the Feedback Hub client. Runs on plain node via the
+// built-in test runner + native TS type-stripping (Node >= 22.18):
+//
+//   node --test tests/feedback.test.mjs
+//
+// This EXECUTES the real helpers from src/services/feedback.ts (which is kept
+// import-free so type-stripping can load it — the `@/` alias is unresolvable
+// here). Static/import-graph guards live in smoke.test.cjs.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  capContent,
+  sanitizeContext,
+  resolveErrorCode,
+  sendFeedback,
+  APP_ID,
+  FEEDBACK_HUB_URL,
+  MAX_CONTENT_LENGTH,
+} from '../src/services/feedback.ts';
+
+test('APP_ID is the exact repo name', () => {
+  assert.equal(APP_ID, 'simpl-liste');
+});
+
+test('capContent trims and caps at MAX_CONTENT_LENGTH', () => {
+  assert.equal(capContent('  hello  '), 'hello');
+  assert.equal(capContent('x'.repeat(3000)).length, MAX_CONTENT_LENGTH);
+  assert.equal(capContent(''), '');
+});
+
+test('sanitizeContext keeps only whitelisted string keys', () => {
+  const out = sanitizeContext({
+    page: '/task/1',
+    locale: 'fr',
+    theme: 'dark',
+    secret: 'nope',
+  });
+  assert.deepEqual(out, { page: '/task/1', locale: 'fr', theme: 'dark' });
+});
+
+test('sanitizeContext truncates values to 500 chars', () => {
+  const out = sanitizeContext({ page: 'a'.repeat(900) });
+  assert.equal(out.page.length, 500);
+});
+
+test('sanitizeContext drops non-string values', () => {
+  const out = sanitizeContext({ page: '/x', viewport: 123 });
+  assert.deepEqual(out, { page: '/x' });
+});
+
+test('sanitizeContext returns undefined when empty or nullish', () => {
+  assert.equal(sanitizeContext(undefined), undefined);
+  assert.equal(sanitizeContext(null), undefined);
+  assert.equal(sanitizeContext({}), undefined);
+  assert.equal(sanitizeContext({ page: '' }), undefined);
+});
+
+test('resolveErrorCode maps statuses, defaulting to server_error', () => {
+  assert.equal(resolveErrorCode(400), 'invalid');
+  assert.equal(resolveErrorCode(429), 'rate_limit');
+  assert.equal(resolveErrorCode(500), 'server_error');
+  assert.equal(resolveErrorCode(413), 'server_error');
+  assert.equal(resolveErrorCode(404), 'server_error');
+});
+
+test('sendFeedback POSTs to the exact endpoint with the right body', async () => {
+  const calls = [];
+  const original = globalThis.fetch;
+  globalThis.fetch = async (url, opts) => {
+    calls.push({ url, opts });
+    return { ok: true, status: 201 };
+  };
+  try {
+    const result = await sendFeedback({
+      content: '  Great app  ',
+      userId: null,
+      context: { page: '/settings' },
+    });
+    assert.deepEqual(result, { ok: true });
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].url, `${FEEDBACK_HUB_URL}/api/feedback`);
+    assert.equal(calls[0].opts.method, 'POST');
+    assert.equal(calls[0].opts.headers['Content-Type'], 'application/json');
+    const body = JSON.parse(calls[0].opts.body);
+    assert.equal(body.app_id, 'simpl-liste');
+    assert.equal(body.content, 'Great app'); // trimmed by capContent
+    assert.equal(body.user_id, null);
+    assert.deepEqual(body.context, { page: '/settings' });
+  } finally {
+    globalThis.fetch = original;
+  }
+});
+
+test('sendFeedback omits context when not opted in, and sends user_id when identified', async () => {
+  const captured = [];
+  const original = globalThis.fetch;
+  globalThis.fetch = async (_url, opts) => {
+    captured.push(JSON.parse(opts.body));
+    return { ok: true, status: 201 };
+  };
+  try {
+    await sendFeedback({ content: 'hi' });
+    assert.equal('context' in captured[0], false);
+    assert.equal(captured[0].user_id, null);
+
+    await sendFeedback({ content: 'hi', userId: 'logto-sub-123' });
+    assert.equal(captured[1].user_id, 'logto-sub-123');
+  } finally {
+    globalThis.fetch = original;
+  }
+});
+
+test('sendFeedback maps error statuses to codes', async () => {
+  const original = globalThis.fetch;
+  const origWarn = console.warn;
+  console.warn = () => {};
+  try {
+    for (const [status, code] of [
+      [400, 'invalid'],
+      [429, 'rate_limit'],
+      [500, 'server_error'],
+      [413, 'server_error'],
+    ]) {
+      globalThis.fetch = async () => ({ ok: false, status });
+      const result = await sendFeedback({ content: 'hi' });
+      assert.deepEqual(result, { ok: false, code });
+    }
+  } finally {
+    globalThis.fetch = original;
+    console.warn = origWarn;
+  }
+});
+
+test('sendFeedback maps thrown fetch to network_error', async () => {
+  const original = globalThis.fetch;
+  const origWarn = console.warn;
+  console.warn = () => {};
+  globalThis.fetch = async () => {
+    throw new Error('offline');
+  };
+  try {
+    const result = await sendFeedback({ content: 'hi' });
+    assert.deepEqual(result, { ok: false, code: 'network_error' });
+  } finally {
+    globalThis.fetch = original;
+    console.warn = origWarn;
+  }
+});

tests/smoke.test.cjs

@@ -129,6 +129,293 @@ check('react-native-android-widget latency patch is wired up', () => {
   assert.equal(pkg.scripts.postinstall, 'patch-package', 'postinstall must run patch-package');
 });
 
+// --- Feedback Hub client guards ---
+// The feedback service is load-bearing on two axes the static check protects:
+// (1) a wrong app_id/endpoint silently misroutes feedback in the shared hub,
+// and (2) it MUST stay import-free — feedback.test.mjs loads it via node:test
+// + TS type-stripping, which cannot resolve the `@/` alias or RN/Expo packages.
+// Behavioral coverage (capContent/sanitizeContext/resolveErrorCode/sendFeedback)
+// lives in tests/feedback.test.mjs; these guards lock the invariants that file
+// can't assert about the source itself.
+
+const FEEDBACK_SRC = 'src/services/feedback.ts';
+
+check('feedback.ts targets the exact feedback.lacompagniemaximus.com /api/feedback endpoint', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', FEEDBACK_SRC), 'utf8');
+  assert.ok(
+    src.includes("'https://feedback.lacompagniemaximus.com'"),
+    'feedback hub URL missing or changed'
+  );
+  assert.ok(src.includes('/api/feedback'), 'endpoint path /api/feedback missing');
+});
+
+check("feedback.ts pins app_id to the exact literal 'simpl-liste'", () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', FEEDBACK_SRC), 'utf8');
+  assert.match(src, /APP_ID\s*=\s*'simpl-liste'/, "APP_ID must be exactly 'simpl-liste'");
+});
+
+check('feedback.ts caps content at 2000 chars', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', FEEDBACK_SRC), 'utf8');
+  assert.match(src, /MAX_CONTENT_LENGTH\s*=\s*2000/, 'content cap must be 2000');
+});
+
+check('feedback.ts stays import-free (protects type-stripping test path)', () => {
+  const imports = staticImportsOf(FEEDBACK_SRC);
+  assert.deepEqual(
+    imports,
+    [],
+    `feedback.ts must have zero imports, found: ${imports.join(', ')}`
+  );
+});
+
+// --- Build toolchain guards ---
+// A blanket `npm audit fix` (PR #118) once rewrote hundreds of lock entries:
+// babel-preset-expo and @expo/metro-config lost their root hoisting and a
+// second Expo SDK was nested inside Expo 54. The tests stayed green while the
+// first Metro bundle failed. These checks lock the layout the build relies on.
+
+const ROOT = path.resolve(__dirname, '..');
+const ROOT_NODE_MODULES = path.join(ROOT, 'node_modules');
+
+function majorOf(version) {
+  return version.split('.')[0];
+}
+
+// Every installed copy of `name`, at the root and nested under other packages.
+function installedCopies(name, dir = ROOT_NODE_MODULES, found = []) {
+  const pkgJson = path.join(dir, name, 'package.json');
+  if (fs.existsSync(pkgJson)) {
+    found.push({ dir: path.dirname(pkgJson), version: require(pkgJson).version });
+  }
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+    const pkgDirs = entry.name.startsWith('@')
+      ? fs.readdirSync(path.join(dir, entry.name)).map((n) => path.join(dir, entry.name, n))
+      : [path.join(dir, entry.name)];
+    for (const pkgDir of pkgDirs) {
+      const nested = path.join(pkgDir, 'node_modules');
+      if (fs.existsSync(nested)) installedCopies(name, nested, found);
+    }
+  }
+  return found;
+}
+
+// babel.config.js and sql-transformer.js require these from the repo root.
+for (const request of ['babel-preset-expo', '@expo/metro-config/babel-transformer']) {
+  check(`${request} resolves from the repo root node_modules`, () => {
+    const resolved = require.resolve(request, { paths: [ROOT] });
+    const pkgName = request.startsWith('@')
+      ? request.split('/').slice(0, 2).join('/')
+      : request.split('/')[0];
+    const expectedDir = path.join(ROOT_NODE_MODULES, pkgName) + path.sep;
+    assert.ok(
+      resolved.startsWith(expectedDir),
+      `${request} resolved to ${resolved}, expected under ${expectedDir}`
+    );
+  });
+}
+
+check('a single Expo SDK major is installed (matches package.json)', () => {
+  const pkg = require('../package.json');
+  const expected = majorOf(pkg.dependencies.expo.replace(/^[~^]/, ''));
+  const copies = installedCopies('expo');
+  assert.ok(copies.length > 0, 'expo is not installed');
+  const strays = copies.filter((c) => majorOf(c.version) !== expected);
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    `expected only expo ${expected}.x`
+  );
+});
+
+check('every installed metro copy honors the 0.83.x override pin', () => {
+  const copies = installedCopies('metro');
+  assert.ok(copies.length > 0, 'metro is not installed');
+  const strays = copies.filter((c) => !/^0\.83\./.test(c.version));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'metro must stay on 0.83.x'
+  );
+});
+
+// @react-navigation/core <= 7.22.0 pulls query-string -> decode-uri-component
+// <= 0.4.2 (GHSA-vcc3-ghjq-m6fr). 7.22.1 parses queries itself, so the deep
+// link round trip must still carry query params through.
+// Scope: this covers @react-navigation/core's own linking helpers only. The
+// app's deep links (simplliste://task/<id>) are resolved by expo-router's fork
+// (expo-router/build/fork/getStateFromPath*.js), which still uses
+// query-string@7 (see #120) and is not exercised here.
+check('@react-navigation/core is >= 7.22.1 and drops query-string', () => {
+  const core = require('@react-navigation/core/package.json');
+  const [major, minor, patch] = core.version.split('.').map(Number);
+  assert.ok(
+    major > 7 || (major === 7 && (minor > 22 || (minor === 22 && patch >= 1))),
+    `@react-navigation/core ${core.version} is vulnerable`
+  );
+  assert.ok(!('query-string' in (core.dependencies || {})), 'core still depends on query-string');
+});
+
+check('@react-navigation/core deep link round trip keeps query params', () => {
+  const { getStateFromPath, getPathFromState } = require('@react-navigation/core');
+  const config = { screens: { Task: 'task/:id' } };
+  const state = getStateFromPath('/task/abc?x=1&y=a%20b', config);
+  assert.deepEqual(state.routes[0].params, { id: 'abc', x: '1', y: 'a b' });
+  assert.equal(getPathFromState(state, config), '/task/abc?x=1&y=a%20b');
+});
+
+// --- Override floors for build-tool transitive deps (#124, #125) ---
+// brace-expansion is overridden per major (version-scoped): a blanket override
+// forces one major onto every minimatch and breaks minimatch@3 (#103). The
+// floors below are the patched head of each major; any other major is either
+// vulnerable (4.x) or unexpected, and must fail loudly.
+
+function versionAtLeast(version, floor) {
+  const a = version.split('.').map(Number);
+  const b = floor.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return true;
+}
+
+const BRACE_EXPANSION_FLOORS = { 1: '1.1.21', 2: '2.1.7', 5: '5.0.12' };
+
+check('every installed brace-expansion copy is at or above its major floor', () => {
+  const copies = installedCopies('brace-expansion');
+  assert.ok(copies.length > 0, 'brace-expansion is not installed');
+  const strays = copies.filter((c) => {
+    const floor = BRACE_EXPANSION_FLOORS[majorOf(c.version)];
+    return !floor || !versionAtLeast(c.version, floor);
+  });
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    `expected floors ${JSON.stringify(BRACE_EXPANSION_FLOORS)}`
+  );
+});
+
+check('every installed undici copy is >= 6.28.1', () => {
+  const copies = installedCopies('undici');
+  assert.ok(copies.length > 0, 'undici is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '6.28.1'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'undici must be >= 6.28.1'
+  );
+});
+
+// --- Override floors (#128, #129) ---
+// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got).
+// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
+// any other major is unexpected and must fail loudly.
+
+check('every installed http-cache-semantics copy is >= 4.3.0', () => {
+  const copies = installedCopies('http-cache-semantics');
+  assert.ok(copies.length > 0, 'http-cache-semantics is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '4.3.0'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'http-cache-semantics must be >= 4.3.0'
+  );
+});
+
+check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () => {
+  const copies = installedCopies('postcss-selector-parser');
+  assert.ok(copies.length > 0, 'postcss-selector-parser is not installed');
+  const strays = copies.filter(
+    (c) => majorOf(c.version) !== '6' || !versionAtLeast(c.version, '6.1.3')
+  );
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'postcss-selector-parser must be 6.x >= 6.1.3'
+  );
+});
+
+// --- Override floors (#133, #134, #135) ---
+// shell-quote: scoped to react-devtools-core (raised from #95's ^1.8.4).
+// compression: scoped to @expo/cli (dev server middleware).
+// source-map-js: version-scoped to major 1 (postcss, tailwindcss pipeline).
+// Each floor is paired with a call to the API its consumer actually uses.
+
+check('every installed shell-quote copy is >= 1.11.0 and still quotes/parses', () => {
+  const copies = installedCopies('shell-quote');
+  assert.ok(copies.length > 0, 'shell-quote is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '1.11.0'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'shell-quote must be >= 1.11.0'
+  );
+  for (const c of copies) {
+    const { quote, parse } = require(c.dir);
+    const where = `shell-quote ${c.version} at ${path.relative(ROOT, c.dir)}`;
+    assert.equal(quote(['code', '-g', 'a b.js:1']), "code -g 'a b.js:1'", `${where}: quote`);
+    assert.deepEqual(parse('a "b c" d'), ['a', 'b c', 'd'], `${where}: parse`);
+  }
+});
+
+check('every installed compression copy is >= 1.8.2 and builds a middleware', () => {
+  const copies = installedCopies('compression');
+  assert.ok(copies.length > 0, 'compression is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '1.8.2'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'compression must be >= 1.8.2'
+  );
+  for (const c of copies) {
+    const middleware = require(c.dir)();
+    assert.equal(typeof middleware, 'function', `compression ${c.version}: middleware`);
+    assert.equal(middleware.length, 3, `compression ${c.version}: (req, res, next) signature`);
+  }
+});
+
+check('every installed source-map-js copy is 1.x >= 1.2.2 and round-trips a mapping', () => {
+  const copies = installedCopies('source-map-js');
+  assert.ok(copies.length > 0, 'source-map-js is not installed');
+  const strays = copies.filter(
+    (c) => majorOf(c.version) !== '1' || !versionAtLeast(c.version, '1.2.2')
+  );
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'source-map-js must be 1.x >= 1.2.2'
+  );
+  for (const c of copies) {
+    const { SourceMapGenerator, SourceMapConsumer } = require(c.dir);
+    const gen = new SourceMapGenerator({ file: 'out.css' });
+    gen.addMapping({
+      source: 'in.css',
+      original: { line: 3, column: 2 },
+      generated: { line: 1, column: 0 },
+    });
+    const pos = new SourceMapConsumer(gen.toJSON()).originalPositionFor({ line: 1, column: 0 });
+    const where = `source-map-js ${c.version} at ${path.relative(ROOT, c.dir)}`;
+    assert.deepEqual([pos.source, pos.line, pos.column], ['in.css', 3, 2], where);
+  }
+});
+
+// The call that broke under the blanket override: each minimatch copy must
+// still expand braces through its own brace-expansion major.
+check('every installed minimatch copy still matches globs and braces', () => {
+  const copies = installedCopies('minimatch');
+  const majors = [...new Set(copies.map((c) => majorOf(c.version)))].sort();
+  assert.deepEqual(majors, ['10', '3', '9'], 'expected minimatch majors 3, 9 and 10');
+  for (const c of copies) {
+    const mod = require(c.dir);
+    const minimatch = mod.minimatch || mod; // v3 exports the function itself
+    const where = `minimatch ${c.version} at ${path.relative(ROOT, c.dir)}`;
+    assert.equal(minimatch('foo/bar.js', '**/*.js'), true, `${where}: globstar`);
+    assert.equal(minimatch('a/b.js', 'a/{b,c}.js'), true, `${where}: brace match`);
+    assert.equal(minimatch('a/d.js', 'a/{b,c}.js'), false, `${where}: brace miss`);
+    assert.equal(minimatch('f3.js', 'f{1..3}.js'), true, `${where}: numeric range`);
+  }
+});
+
 if (failed === 0) {
   console.log('\nsmoke OK');
   process.exit(0);