maximus/simpl-liste
1
0
Fork 0
Code Issues 4 Pull requests Projects Releases 20 Packages Wiki Activity Actions

Compare commits

base: maximus:v1.6.6
Branches Tags
maximus:master
maximus:issue-121-xmldom-js-yaml-floors
maximus:issue-117-react-navigation-core-7.22.1
maximus:v1.6.6
maximus:v1.6.5
maximus:v1.6.4
maximus:v1.6.3
maximus:v1.6.2
maximus:v1.6.1
maximus:v1.6.0
maximus:v1.5.2
maximus:v1.5.1
maximus:v1.5.0
maximus:v1.4.0
maximus:v1.3.0
maximus:v1.2.5
maximus:v1.2.4
maximus:v1.2.3
maximus:v1.2.2
maximus:v1.2.1
maximus:v1.2.0
maximus:v1.1.0
maximus:v1.0.1
maximus:v1.0.0
...
compare: maximus:master
Branches Tags
maximus:master
maximus:issue-121-xmldom-js-yaml-floors
maximus:issue-117-react-navigation-core-7.22.1
maximus:v1.6.6
maximus:v1.6.5
maximus:v1.6.4
maximus:v1.6.3
maximus:v1.6.2
maximus:v1.6.1
maximus:v1.6.0
maximus:v1.5.2
maximus:v1.5.1
maximus:v1.5.0
maximus:v1.4.0
maximus:v1.3.0
maximus:v1.2.5
maximus:v1.2.4
maximus:v1.2.3
maximus:v1.2.2
maximus:v1.2.1
maximus:v1.2.0
maximus:v1.1.0
maximus:v1.0.1
maximus:v1.0.0

22 commits
v1.6.6 ... master

Author SHA1 Message Date
le king fu
085b8e7d75 state: sync after #133, #134, #135 (PR #138) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-06 19:13:13 -04:00
le king fu
8b27054be9 fix(security): raise shell-quote, add compression and source-map-js floors 
- react-devtools-core > shell-quote ^1.8.4 -> ^1.11.0 (GHSA-pqg4-j6r4-53mv,
  critical, quote() command injection; resolves 1.12.0). Raises the #95 floor.
- @expo/cli > compression ^1.8.2 (GHSA-vc2v-76pw-4v95, high, dev server DoS).
- source-map-js@^1.0.0 -> ^1.2.2 (GHSA-68fv-2mgg-jv7q, high, postcss pipeline).

Lock: only the three package entries change, package key set identical.
Smoke test: floor guard plus a call to the consumed API for each package.
Export bundle byte-identical before/after (44 files). npm audit 43 -> 40,
critical 0. Build and dev tooling only, nothing ships in the APK.

Fixes #133
Fixes #134
Fixes #135

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-06 19:07:48 -04:00
le king fu
aa41642a87 state: sync after #128, #129 (PR #131), #126 and #130 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 19:35:17 -04:00
le king fu
cb53a43422 fix(security): scope http-cache-semantics floor to major 4 
Review follow-up on #131: a blanket override would force any future 5.x
consumer down to 4.x. The version-scoped key keeps the floor within the
current major, like postcss-selector-parser. No lockfile change.

Refs #128

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 19:34:25 -04:00
le king fu
62efdba22e fix(security): add http-cache-semantics and postcss-selector-parser floors 
- http-cache-semantics ^4.3.0 (GHSA-ch52-4w7c-c8xp, high): 4.3.0 is out of
  the <=4.2.0 range although the advisory lists no patched version. Single
  copy via @expo/ngrok > got > cacheable-request (^4.0.0), dev tunnel only.
- postcss-selector-parser@^6.0.0 -> ^6.1.3 (GHSA-w9m9-85wc-3x92, low),
  version-scoped to the tailwindcss@3 major. Resolves to 6.1.4.

Lockfile: two stanzas, package count unchanged (2084). npm audit 33 -> 31.
Android JS bundle (expo export --no-bytecode, cache cleared) is byte-identical
before and after. Smoke test guards both floors.

Resolves #128
Resolves #129

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 19:27:33 -04:00
le king fu
84048e976c state: sync after #124 and #125 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 14:14:44 -04:00
maximus
35ab0f64ae Merge pull request 'fix(security): raise brace-expansion and undici override floors' (#127) from issue-124-125-brace-expansion-undici-floors into master 2026-10-02 18:14:26 +00:00
le king fu
84d04184ae fix(security): raise brace-expansion and undici override floors 
brace-expansion: nine new DoS advisories outdate the floors set in #103.
Raise the three version-scoped overrides to the patched head of each
major (1.1.21, 2.1.7, 5.0.12). undici: raise the @expo/cli scoped
override to ^6.28.1 (resolves to 6.29.0).

Add smoke checks locking the floors and the minimatch brace/glob
behaviour for every installed minimatch major, so a return to a blanket
override fails the suite.

npm audit: 12 -> 10 entries. The rest is tracked in #123 and #126.

Fixes #124
Fixes #125

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 14:11:34 -04:00
le king fu
99ecb73615 chore: ignore .next/ and reports/ 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-27 15:52:56 -04:00
le king fu
dacd1c285e state: sync after #120 analysis (accepted risk, unreachable) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-27 15:41:29 -04:00
le king fu
f9bed16554 state: sync after #121 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 20:28:08 -04:00
maximus
4c2fe06f68 Merge pull request 'fix(security): raise @xmldom/xmldom and js-yaml override floors' (#122) from issue-121-xmldom-js-yaml-floors into master 2026-09-26 00:27:54 +00:00
le king fu
100078e1e2 fix(security): raise @xmldom/xmldom and js-yaml override floors 
Advisories published on 2026-09-08 land above the current floors:
- @xmldom/xmldom <= 0.8.14 (GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4,
  GHSA-93r5-fhx6-vmg9 and 7 more), patched in 0.8.15 (lts line)
- js-yaml < 3.15.2 / < 4.3.2 (GHSA-2883-xcg3-v3hh)

Raise the three overrides. Lock diff is limited to the three entries.
All consumers are build-time tooling (@expo/plist, plist via xcode,
@expo/xcpretty, @istanbuljs/load-nyc-config); the Android bundle hash
is unchanged.

Fixes #121

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 20:10:07 -04:00
le king fu
967929ee04 state: sync after #117 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 20:04:32 -04:00
maximus
53c33e73a4 Merge pull request 'fix(security): bump @react-navigation/core to 7.22.1 via override' (#119) from issue-117-react-navigation-core-7.22.1 into master 2026-09-26 00:04:06 +00:00
le king fu
2117cc5016 test: clarify deep link round trip scope (expo-router fork not covered) 
Refs #117

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-25 19:59:17 -04:00
le king fu
f7b2b51da9 fix(security): bump @react-navigation/core to 7.22.1 via override 
@react-navigation/core <= 7.22.0 depends on query-string, which pulls
decode-uri-component <= 0.4.2 (GHSA-vcc3-ghjq-m6fr, DoS on malformed
percent-encoded input). 7.22.1 parses queries itself and drops the
dependency. A scoped override bumps it without touching anything else:
the lock diff is limited to @react-navigation/core and /routers.

Add smoke-test guards for the failure mode of the superseded PR #118
(blanket npm audit fix): babel-preset-expo and @expo/metro-config must
resolve from the root node_modules, only one Expo SDK major may be
installed, every metro copy must stay on 0.83.x. Replayed against the
PR #118 lock, all four checks fail. Also add a deep link round trip
through getStateFromPath/getPathFromState with query params.

Fixes #117

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-24 20:40:36 -04:00
maximus
813b9de2ea Merge pull request 'fix(security): raise browserslist floor to 4.28.7 via override' (#116) from issue-115-browserslist-4.28.7 into master 2026-09-04 20:27:38 +00:00
le king fu
dfd4004cdc state: sync after #108 and #115 
Version was still recorded as 1.6.4/16 while master is at 1.6.6/18.
Records the security remediation outcome (19 vulns / 9 HIGH -> 10 / 0
HIGH), the override inventory, and the three @expo/metro shims that no
longer resolve under metro 0.83.8 -- inert today, but worth re-checking
at the next Expo SDK bump.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Y4GzEsmDryrwtQcmBNw9P
 2026-09-04 16:25:04 -04:00
le king fu
5e7a566155 fix(security): raise browserslist floor to 4.28.7 via override 
browserslist <= 4.28.6 carries two HIGH advisories published 2026-09-01:
GHSA-c83g-rgw3-j3cx (unbounded memory growth, no cache eviction, leading
to OOM) and GHSA-73wf-gq98-2v4g (uncaught crash / prototype write via an
untrusted browserslist-stats.json in normalizeStats). Both report
first_patched_version = 4.28.7.

Unlike the image-size root fixed in #114, this one has a published fix,
so a plain version floor is enough. Every requester already uses a caret
range compatible with 4.28.7 (@babel/helper-compilation-targets ^4.24.0,
@expo/metro-config ^4.25.0, core-js-compat ^4.28.1, update-browserslist-db
peer >= 4.21.0) -- the lock was simply pinned at 4.28.1. The override
records the security floor the same way as the existing esbuild,
@xmldom/xmldom, postcss, brace-expansion and @babel/core entries.

Resolves to 4.28.9. npm audit: 11 -> 10 total, 1 HIGH -> 0 HIGH. No high
or critical finding remains in the tree.

Verified: the lock stays unchanged under re-resolution against
package.json, npm ci accepts the pair (what EAS runs), npm test 11/11,
and expo export --platform android emits a byte-identical Hermes bundle
(index-3d9ab1a7942c6dfccc79d9b280b8ce80.hbc, 8.17 MB) -- the compilation
targets browserslist resolves are unchanged.

Refs #115

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Y4GzEsmDryrwtQcmBNw9P
 2026-09-04 16:23:46 -04:00
maximus
eff15ca9b8 Merge pull request 'fix(security): drop image-size via metro 0.83.8 overrides' (#114) from issue-108-metro-0.83.8 into master 2026-09-04 20:16:40 +00:00
le king fu
290c4e5e2f fix(security): drop image-size via metro 0.83.8 overrides 
metro@0.83.8 (published 2026-08-19) removed the image-size dependency and
vendored a reduced dimension parser (src/lib/imageSize.js) that supports
only bmp/gif/jpeg/ktx/png/psd/svg/tiff/webp. The ICNS, JXL and HEIF
parsers named by GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq are absent
from it, so the DoS is eliminated by construction rather than by an
upstream patch: image-size still publishes no fixed version (latest is
2.0.2, and both advisories report first_patched_version = None).

metro@0.83.3 was the only requester of image-size in the whole tree, so
every transitive HIGH finding collapses with it.

@expo/metro@54.2.0 pins the 14 metro packages to exact 0.83.3, so npm
update cannot move them and an override is required. All 14 are moved
together to avoid a mixed metro tree; the existing nested ws override is
preserved through the "." key.

npm audit: 19 -> 11 total, 9 HIGH -> 1 HIGH. The remaining HIGH
(browserslist) is unrelated and pre-existing on master.

Verified: image-size absent from both the lock file and node_modules,
14 metro packages resolved to 0.83.8 with no duplicates, patch-package
postinstall still applies, npm test 11/11, and expo export --platform
android produces a Hermes bundle with PNG dimension variations resolved
through the vendored parser.

Refs #108

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Y4GzEsmDryrwtQcmBNw9P
 2026-09-04 15:57:51 -04:00
5 changed files with 582 additions and 253 deletions
Show stats Expand all files Collapse all files

6
.gitignore vendored
View file

@ -40,3 +40,9 @@ yarn-error.*
# generated native folders
/ios
/android
# Next.js build output (web companion)
/.next/
# autopilot daily reports
/reports/

56
STATE.md
View file

@ -1,13 +1,34 @@
# STATE — simpl-liste
> Derniere MAJ : 2026-07-27 (par fix-issue #68)
> Derniere MAJ : 2026-10-06 (par fix-issue #133, #134, #135 — PR #138)
## Position actuelle
Version 1.6.4 (versionCode 16). Remediation vulnerabilites du defenseur en cours
via overrides `@xmldom/xmldom@^0.8.13` et `uuid@^11.0.0` dans `package.json`
(overnight 2026-04-24). 4 CVE HIGH xmldom nettoyees ; 1 advisory uuid residuelle
non-exploitable en pratique (details dans `SECURITY.md`).
Version 1.6.6 (versionCode 18). `npm audit` = 40 entrees (0 critical) au 2026-10-06 apres
PR #138, pour 5 advisories sans correctif publie (le reste est de la cascade de parents) :
`braces` (high, #130), `node-forge` (high, #123), `postcss-selector-parser` GHSA-rj75
(moderate, #136, sortie = tailwind 4), `sprintf-js` (moderate, #137) et la chaine
`expo-router` -> `query-string@7` -> `decode-uri-component` (risque accepte #120). Toutes
sont de l'outillage de build/dev : rien dans l'APK.
La remediation passe par des overrides de plancher dans `package.json` :
`esbuild`, `@xmldom/xmldom@^0.8.15`, `uuid`, `postcss`, `js-yaml` (3.15.2 / 4.3.2), `brace-expansion` (1.1.21 / 2.1.7 / 5.0.12),
`@babel/core`, `browserslist@^4.28.7`, `@react-navigation/core@^7.22.1`,
`http-cache-semantics@^4` (4.3.0), `postcss-selector-parser@^6` (6.1.3), `source-map-js@^1` (1.2.2),
`react-devtools-core > shell-quote` (^1.11.0), `@expo/cli > compression` (^1.8.2), et les 14
paquets `metro@^0.83.8`. Le smoke test verrouille la chaine de build (presets Expo
hoistes a la racine, un seul SDK Expo, metro 0.83.x partout) et les planchers
`brace-expansion` / `undici` / `http-cache-semantics` / `postcss-selector-parser` /
`shell-quote` / `compression` / `source-map-js` (plancher + appel de l'API consommee) /
comportement de `minimatch` (majeurs 3, 9, 10).
**Caveat sur l'override metro** (releve par la review de PR #114) : `0.83.3 -> 0.83.8`
n'est pas un bump de patch pur cote API privee. Trois shims de `@expo/metro@54.2.0`,
ecrit contre 0.83.3, ne resolvent plus — `metro-resolver/utils/toPosixPath` et
`metro/node-haste/Package` supprimes, `metro-file-map/lib/dependencyExtractor` deplace.
Ils leveraient `MODULE_NOT_FOUND`, mais **aucun paquet de l'arbre ne les requiert**
(203 des 206 imports profonds `metro*/private/...` resolvent). Inerte aujourd'hui ;
a re-verifier au prochain bump du SDK Expo ou de `@expo/metro`.
Companion web `liste.lacompagniemaximus.com` : deploye **manuellement** (docker-compose
standalone `/data/simpl-liste-web` sur le VPS, build depuis `source/` rsync — PAS une app
@ -15,16 +36,21 @@ Coolify malgre la spec). Procedure en memoire `simpl-liste-web-deploy`.
## Decisions recentes
- 2026-07-27 : #68 merged (PR #101) — Feedback Hub integre (bouton Reglages > A propos, POST feedback.lacompagniemaximus.com app_id simpl-liste, opt-in contexte + identite Loi 25 ; client sans dependance teste via node:test).
- 2026-05-30 : #90 merged (PR #93, ThemeToggle eslint-disable) + premier deploy web depuis 7 sem (rsync source/ + docker compose --build sur VPS) — #70 et #90 live sur liste.lacompagniemaximus.com.
- 2026-05-30 : PR #89 merged — display name web resolu via userInfo (ordre fallback de la vitrine), fix #70.
- 2026-05-30 : nettoyage lint web/ (PR #91, 2 prefer-const + import inutilise) ; #90 analyse (ThemeToggle set-state-in-effect, decision : eslint-disable documente).
- 2026-05-10 : Aligne 6 patches Expo SDK 54 via expo install --fix — expo-doctor 17/17 (ref #87)
- 2026-05-08 : Defenseur rerun confirme 0 findings — overrides existants suffisent, pas de PR necessaire (ref #81)
- 2026-04-24 : overrides xmldom + uuid (spec `spec-decisions-vuln-simpl-liste.md`) — PRs #77, #78, #79 (pending-human).
- 2026-04-23 : PR #71 merged — fix widget render-optimiste + timing instrumentation.
- 2026-04-18 : archive milestone `spec-simpl-liste-web` (12/12 done).
- 2026-10-06 : #133, #134, #135 fermees (PR #138 merged) — `shell-quote` ^1.11.0 (CRITICAL GHSA-pqg4, releve le plancher de #95), `@expo/cli > compression` ^1.8.2 (HIGH), `source-map-js@^1.0.0` ^1.2.2 (HIGH, pipeline CSS). `npm audit` 43 -> 40, critical 0. Export identique octet pour octet (44 fichiers), serveur de dev sert le bundle en gzip. Ouvertes le meme jour en plancher : #136 (`postcss-selector-parser` GHSA-rj75, aucun correctif 6.x) et #137 (`sprintf-js`, tete publiee vulnerable). `/analyse-vulnerabilite` cherche desormais les antecedents fermes avant de proposer.
- 2026-10-05 : #128 et #129 fermees (PR #131 merged) — planchers version-scoped `http-cache-semantics@^4.0.0` -> ^4.3.0 (GHSA-ch52 high : l'advisory ne liste aucun patch, mais 4.3.0 sort de la borne `<=4.2.0` ; tunnel `@expo/ngrok` seulement) et `postcss-selector-parser@^6.0.0` -> ^6.1.3 (low, pipeline tailwind). `npm audit` 33 -> 31. Preuve du livrable : bundle JS (`expo export --no-bytecode --clear`) identique octet pour octet. **Le hash `.hbc` n'est pas une preuve** : Hermes n'est pas deterministe ici (deux exports du meme arbre different).
- 2026-10-05 : #126 fermee, acceptation de #120 maintenue — `decode-uri-component@0.5.0` est ESM pur, `query-string@7` le `require()`. Declencheur de sortie : `expo-router@58.0.13` (SDK 58) retire `query-string`, pas encore backporte sur sdk-54..57. #130 ouverte : `braces` plancher (3.0.3 = tete publiee, vulnerable).
- 2026-10-02 : #124 et #125 fermees (PR #127 merged) — planchers `brace-expansion` ^1.1.21 / ^2.1.7 / ^5.0.12 (9 advisories DoS neuves, toujours version-scoped) et `@expo/cli > undici` ^6.28.1 (resolu 6.29.0). Outillage de build seulement. Trois gardes au smoke test, dont le test `minimatch` qui manquait depuis #103. `npm audit` 12 -> 10. Ouvertes le meme jour : #123 (`node-forge`, tete publiee 1.4.0 vulnerable) et #126 (`decode-uri-component@0.5.0` publiee).
- 2026-09-27 : #120 fermee en risque accepte (rectification du cadrage « attend un bump de SDK »). Aucune version d'expo-router (jusqu'a 58.0.8 / sdk-57) ne quitte `query-string@7`. expo-router n'appelle que `queryString.stringify()`, qui ne touche jamais `decode-uri-component` (le seul `parse()` du fork est commente) : code vulnerable inatteignable. A re-verifier a chaque bump d'expo-router.
- 2026-09-25 : #121 fermee (PR #122 merged) — planchers `@xmldom/xmldom@^0.8.15` et `js-yaml` ^3.15.2 / ^4.3.2 (advisories HIGH du 2026-09-08, outillage de build seulement, hash du bundle Hermes inchange). Le Defenseur ne les avait pas signalees : hypothese de dedup par paquet contre issues fermees -> agent-defenseurs#139.
- 2026-09-25 : #117 fermee (PR #119 merged) — override `@react-navigation/core@^7.22.1`, qui ne depend plus de `query-string` (GHSA-vcc3-ghjq-m6fr). Lock : 2 entrees. PR #118 du Defenseur fermee : son `npm audit fix` global desinstallait `babel-preset-expo`/`@expo/metro-config` de la racine et nichait un Expo 57 (build casse, tests verts). Gardes de toolchain ajoutees au smoke test. Residu `expo-router` -> #120.
- 2026-09-04 : #115 ouverte + PR #116 — `browserslist@^4.28.7` (2 advisories HIGH publiees le 2026-09-01, `first_patched_version = 4.28.7`). Resout en 4.28.9, derniere HIGH de l'arbre. Bundle Hermes au hash identique avant/apres : cibles de compilation inchangees.
- 2026-09-04 : #112 fermee doublon de #108 ; PR #113 fermee sans merge (son diff ne contenait aucune occurrence d'`image-size` — 633/584 de churn de lockfile sans rapport).
- 2026-09-04 : #108 fermee (PR #114 merged) — `image-size` retiree de l'arbre via overrides `metro@^0.83.8`. Le blocage upstream tient toujours (`first_patched_version = None`, `2.0.2` reste la derniere publiee) ; c'est metro qui a **supprime** la dependance et vendore un parseur reduit sans les formats ICNS/JXL/HEIF vises. Backport sur la ligne 0.83.x le 2026-08-19 — pas besoin du bump de SDK Expo anticipe. 9 HIGH -> 1 HIGH.
## Blockers actifs
Aucun.
- Essai sur appareil a faire avant le prochain APK : core 7.22.1 tourne avec native/native-stack/bottom-tabs publies contre 7.14 (deep link vers une tache, onglets, pile).
- #130 : `braces` <=3.0.3 sans version corrigee. Surveiller `braces` > 3.0.3 ou `micromatch` qui la largue.
- #123 : `node-forge` <=1.4.0 sans version corrigee. Surveiller `node-forge` > 1.4.0 ou le retrait de la dependance par `@expo/code-signing-certificates` / `@expo/cli`.
- #136 : `postcss-selector-parser` GHSA-rj75 sans correctif 6.x. Surveiller un backport 6.x ou la migration NativeWind 5 / tailwind 4.
- #137 : `sprintf-js` <=1.1.3 sans version corrigee. Surveiller une version hors borne ou une `@istanbuljs/load-nyc-config` 2.x.

485
package-lock.json generated
View file

@ -1536,25 +1536,6 @@
"node": ">=6.9.0"
}
},
"node_modules/@babel/traverse--for-generate-function-map": {
"name": "@babel/traverse",
"version": "7.29.0",
"resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
"integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
"license": "MIT",
"dependencies": {
"@babel/code-frame": "^7.29.0",
"@babel/generator": "^7.29.0",
"@babel/helper-globals": "^7.28.0",
"@babel/parser": "^7.29.0",
"@babel/template": "^7.28.6",
"@babel/types": "^7.29.0",
"debug": "^4.3.1"
},
"engines": {
"node": ">=6.9.0"
}
},
"node_modules/@babel/types": {
"version": "7.29.8",
"resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
@ -2732,9 +2713,9 @@
}
},
"node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
"version": "3.15.1",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz",
"integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
"version": "3.15.2",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
"integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
"license": "MIT",
"dependencies": {
"argparse": "^1.0.7",
@ -3308,9 +3289,9 @@
}
},
"node_modules/@react-native/codegen/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
@ -3487,16 +3468,15 @@
}
},
"node_modules/@react-navigation/core": {
"version": "7.14.0",
"resolved": "https://registry.npmjs.org/@react-navigation/core/-/core-7.14.0.tgz",
"integrity": "sha512-tMpzskBzVp0E7CRNdNtJIdXjk54Kwe/TF9ViXAef+YFM1kSfGv4e/B2ozfXE+YyYgmh4WavTv8fkdJz1CNyu+g==",
"version": "7.22.1",
"resolved": "https://registry.npmjs.org/@react-navigation/core/-/core-7.22.1.tgz",
"integrity": "sha512-6JAaYM4u6RPtVMUjN5ovX5DNBdBZtDqebk7kEwlncUP6fP4P94+qEYv1bRmtxSFs7UxiZwQQs+jzTsBaW2WeyA==",
"license": "MIT",
"dependencies": {
"@react-navigation/routers": "^7.5.3",
"@react-navigation/routers": "^7.6.4",
"escape-string-regexp": "^4.0.0",
"fast-deep-equal": "^3.1.3",
"nanoid": "^3.3.11",
"query-string": "^7.1.3",
"react-is": "^19.1.0",
"use-latest-callback": "^0.2.4",
"use-sync-external-store": "^1.5.0"
@ -3565,9 +3545,9 @@
}
},
"node_modules/@react-navigation/routers": {
"version": "7.5.3",
"resolved": "https://registry.npmjs.org/@react-navigation/routers/-/routers-7.5.3.tgz",
"integrity": "sha512-1tJHg4KKRJuQ1/EvJxatrMef3NZXEPzwUIUZ3n1yJ2t7Q97siwRtbynRpQG9/69ebbtiZ8W3ScOZF/OmhvM4Rg==",
"version": "7.6.4",
"resolved": "https://registry.npmjs.org/@react-navigation/routers/-/routers-7.6.4.tgz",
"integrity": "sha512-GI7eJm8/KsZUQaYcXvEExikKurRZRgEsSzyZ7faENfi65yqJBCXjDMwyN1pF6pNW1MoLH1ErDwDivFxY6BzD3w==",
"license": "MIT",
"dependencies": {
"nanoid": "^3.3.11"
@ -3817,9 +3797,9 @@
}
},
"node_modules/@xmldom/xmldom": {
"version": "0.8.13",
"resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz",
"integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==",
"version": "0.8.15",
"resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz",
"integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
@ -4269,9 +4249,9 @@
"license": "MIT"
},
"node_modules/baseline-browser-mapping": {
"version": "2.10.0",
"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
"integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
"version": "2.11.21",
"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz",
"integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==",
"license": "Apache-2.0",
"bin": {
"baseline-browser-mapping": "dist/cli.cjs"
@ -4358,9 +4338,9 @@
}
},
"node_modules/brace-expansion": {
"version": "5.0.9",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
"integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"version": "5.0.12",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
@ -4391,9 +4371,9 @@
}
},
"node_modules/browserslist": {
"version": "4.28.1",
"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
"integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
"version": "4.28.9",
"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz",
"integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==",
"funding": [
{
"type": "opencollective",
@ -4410,11 +4390,11 @@
],
"license": "MIT",
"dependencies": {
"baseline-browser-mapping": "^2.9.0",
"caniuse-lite": "^1.0.30001759",
"electron-to-chromium": "^1.5.263",
"node-releases": "^2.0.27",
"update-browserslist-db": "^1.2.0"
"baseline-browser-mapping": "^2.11.20",
"caniuse-lite": "^1.0.30001810",
"electron-to-chromium": "^1.5.420",
"node-releases": "^2.0.54",
"update-browserslist-db": "^1.3.2"
},
"bin": {
"browserslist": "cli.js"
@ -4621,9 +4601,9 @@
}
},
"node_modules/caniuse-lite": {
"version": "1.0.30001770",
"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001770.tgz",
"integrity": "sha512-x/2CLQ1jHENRbHg5PSId2sXq1CIO1CISvwWAj027ltMVG2UNgW+w9oH2+HzgEIRFembL8bUlXtfbBHR1fCg2xw==",
"version": "1.0.30001810",
"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
"integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
"funding": [
{
"type": "opencollective",
@ -4881,14 +4861,15 @@
}
},
"node_modules/compression": {
"version": "1.8.1",
"resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
"integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
"version": "1.8.2",
"resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz",
"integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==",
"license": "MIT",
"dependencies": {
"bytes": "3.1.2",
"compressible": "~2.0.18",
"debug": "2.6.9",
"destroy": "1.2.0",
"negotiator": "~0.6.4",
"on-headers": "~1.1.0",
"safe-buffer": "5.2.1",
@ -4896,6 +4877,10 @@
},
"engines": {
"node": ">= 0.8.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/compression/node_modules/debug": {
@ -4958,6 +4943,19 @@
"integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
"license": "MIT"
},
"node_modules/content-type": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
"integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
"license": "MIT",
"engines": {
"node": ">=18"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/convert-source-map": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@ -5534,9 +5532,9 @@
"license": "MIT"
},
"node_modules/electron-to-chromium": {
"version": "1.5.302",
"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.302.tgz",
"integrity": "sha512-sM6HAN2LyK82IyPBpznDRqlTQAtuSaO+ShzFiWTvoMJLHyZ+Y39r8VMfHzwbU8MVBzQ4Wdn85+wlZl2TLGIlwg==",
"version": "1.5.422",
"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.422.tgz",
"integrity": "sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA==",
"license": "ISC"
},
"node_modules/emoji-regex": {
@ -6411,9 +6409,9 @@
}
},
"node_modules/expo/node_modules/brace-expansion": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
"integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
"version": "2.1.7",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
"integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0"
@ -7075,9 +7073,9 @@
}
},
"node_modules/http-cache-semantics": {
"version": "4.2.0",
"resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
"integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
"version": "4.3.0",
"resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
"integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
"license": "BSD-2-Clause"
},
"node_modules/http-errors": {
@ -7201,21 +7199,6 @@
"node": ">= 4"
}
},
"node_modules/image-size": {
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/image-size/-/image-size-1.2.1.tgz",
"integrity": "sha512-rH+46sQJ2dlwfjfhCyNx5thzrv+dtmBIhPHk0zgRUukHzZ/kRueTJXoYYsclBaKcSMBWuGbOFXtioLpzTb5euw==",
"license": "MIT",
"dependencies": {
"queue": "6.0.2"
},
"bin": {
"image-size": "bin/image-size.js"
},
"engines": {
"node": ">=16.x"
}
},
"node_modules/imurmurhash": {
"version": "0.1.4",
"resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
@ -7718,9 +7701,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
"version": "4.3.1",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
"integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"version": "4.3.2",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
"integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
"funding": [
{
"type": "github",
@ -8386,45 +8369,43 @@
}
},
"node_modules/metro": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro/-/metro-0.83.3.tgz",
"integrity": "sha512-+rP+/GieOzkt97hSJ0MrPOuAH/jpaS21ZDvL9DJ35QYRDlQcwzcvUlGUf79AnQxq/2NPiS/AULhhM4TKutIt8Q==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro/-/metro-0.83.8.tgz",
"integrity": "sha512-ZbJDJCDlvv0O3QHVbhZkyP2/DtebfEoDZ3wVyYHgu6Uoy6DmmE/bis6lIDBYh+kWPuaueJDegyutPjkIBLtZDQ==",
"license": "MIT",
"dependencies": {
"@babel/code-frame": "^7.24.7",
"@babel/code-frame": "^7.29.0",
"@babel/core": "^7.25.2",
"@babel/generator": "^7.25.0",
"@babel/parser": "^7.25.3",
"@babel/template": "^7.25.0",
"@babel/traverse": "^7.25.3",
"@babel/types": "^7.25.2",
"accepts": "^1.3.7",
"chalk": "^4.0.0",
"@babel/generator": "^7.29.1",
"@babel/parser": "^7.29.0",
"@babel/template": "^7.28.6",
"@babel/traverse": "^7.29.0",
"@babel/types": "^7.29.0",
"accepts": "^2.0.0",
"ci-info": "^2.0.0",
"connect": "^3.6.5",
"debug": "^4.4.0",
"error-stack-parser": "^2.0.6",
"flow-enums-runtime": "^0.0.6",
"graceful-fs": "^4.2.4",
"hermes-parser": "0.32.0",
"image-size": "^1.0.2",
"hermes-parser": "0.35.0",
"invariant": "^2.2.4",
"jest-worker": "^29.7.0",
"jsc-safe-url": "^0.2.2",
"lodash.throttle": "^4.1.1",
"metro-babel-transformer": "0.83.3",
"metro-cache": "0.83.3",
"metro-cache-key": "0.83.3",
"metro-config": "0.83.3",
"metro-core": "0.83.3",
"metro-file-map": "0.83.3",
"metro-resolver": "0.83.3",
"metro-runtime": "0.83.3",
"metro-source-map": "0.83.3",
"metro-symbolicate": "0.83.3",
"metro-transform-plugins": "0.83.3",
"metro-transform-worker": "0.83.3",
"mime-types": "^2.1.27",
"metro-babel-transformer": "0.83.8",
"metro-cache": "0.83.8",
"metro-cache-key": "0.83.8",
"metro-config": "0.83.8",
"metro-core": "0.83.8",
"metro-file-map": "0.83.8",
"metro-resolver": "0.83.8",
"metro-runtime": "0.83.8",
"metro-source-map": "0.83.8",
"metro-symbolicate": "0.83.8",
"metro-transform-plugins": "0.83.8",
"metro-transform-worker": "0.83.8",
"mime-types": "^3.0.1",
"nullthrows": "^1.1.1",
"serialize-error": "^2.1.0",
"source-map": "^0.5.6",
@ -8440,14 +8421,15 @@
}
},
"node_modules/metro-babel-transformer": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-babel-transformer/-/metro-babel-transformer-0.83.3.tgz",
"integrity": "sha512-1vxlvj2yY24ES1O5RsSIvg4a4WeL7PFXgKOHvXTXiW0deLvQr28ExXj6LjwCCDZ4YZLhq6HddLpZnX4dEdSq5g==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-babel-transformer/-/metro-babel-transformer-0.83.8.tgz",
"integrity": "sha512-tnn0J5wzgTgTx2OJy3Cwr1y79bJz4eNgFQd+2HENOs5Vz6QOMnt05z7J+BedIo9wIbpEa0iN9U1nerxyvMRE9g==",
"license": "MIT",
"dependencies": {
"@babel/core": "^7.25.2",
"flow-enums-runtime": "^0.0.6",
"hermes-parser": "0.32.0",
"hermes-parser": "0.35.0",
"metro-cache-key": "0.83.8",
"nullthrows": "^1.1.1"
},
"engines": {
@ -8455,39 +8437,39 @@
}
},
"node_modules/metro-babel-transformer/node_modules/hermes-estree": {
"version": "0.32.0",
"resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.32.0.tgz",
"integrity": "sha512-KWn3BqnlDOl97Xe1Yviur6NbgIZ+IP+UVSpshlZWkq+EtoHg6/cwiDj/osP9PCEgFE15KBm1O55JRwbMEm5ejQ==",
"version": "0.35.0",
"resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.35.0.tgz",
"integrity": "sha512-xVx5Opwy8Oo1I5yGpVRhCvWL/iV3M+ylksSKVNlxxD90cpDpR/AR1jLYqK8HWihm065a6UI3HeyAmYzwS8NOOg==",
"license": "MIT"
},
"node_modules/metro-babel-transformer/node_modules/hermes-parser": {
"version": "0.32.0",
"resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.32.0.tgz",
"integrity": "sha512-g4nBOWFpuiTqjR3LZdRxKUkij9iyveWeuks7INEsMX741f3r9xxrOe8TeQfUxtda0eXmiIFiMQzoeSQEno33Hw==",
"version": "0.35.0",
"resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.35.0.tgz",
"integrity": "sha512-9JLjeHxBx8T4CAsydZR49PNZUaix+WpQJwu9p2010lu+7Kwl6D/7wYFFJxoz+aXkaaClp9Zfg6W6/zVlSJORaA==",
"license": "MIT",
"dependencies": {
"hermes-estree": "0.32.0"
"hermes-estree": "0.35.0"
}
},
"node_modules/metro-cache": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-cache/-/metro-cache-0.83.3.tgz",
"integrity": "sha512-3jo65X515mQJvKqK3vWRblxDEcgY55Sk3w4xa6LlfEXgQ9g1WgMh9m4qVZVwgcHoLy0a2HENTPCCX4Pk6s8c8Q==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-cache/-/metro-cache-0.83.8.tgz",
"integrity": "sha512-aogMG5WbKzW5000otNjYrS9hIoORzkCI1faPJK+vxQLaf2BorJKBBFe/jl2Tfsi1mZUglS2EBuBt8B3JB7MYDQ==",
"license": "MIT",
"dependencies": {
"exponential-backoff": "^3.1.1",
"flow-enums-runtime": "^0.0.6",
"https-proxy-agent": "^7.0.5",
"metro-core": "0.83.3"
"metro-core": "0.83.8"
},
"engines": {
"node": ">=20.19.4"
}
},
"node_modules/metro-cache-key": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-cache-key/-/metro-cache-key-0.83.3.tgz",
"integrity": "sha512-59ZO049jKzSmvBmG/B5bZ6/dztP0ilp0o988nc6dpaDsU05Cl1c/lRf+yx8m9WW/JVgbmfO5MziBU559XjI5Zw==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-cache-key/-/metro-cache-key-0.83.8.tgz",
"integrity": "sha512-I38PtcjT4crS5HY9UQ8i6z8S7tJ2WewtPGr/OwS6FcLKfy5T/1hlTaFw+wozUZkEtNpR6Gc0oJuvuKCbSoSN5A==",
"license": "MIT",
"dependencies": {
"flow-enums-runtime": "^0.0.6"
@ -8497,18 +8479,18 @@
}
},
"node_modules/metro-config": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-config/-/metro-config-0.83.3.tgz",
"integrity": "sha512-mTel7ipT0yNjKILIan04bkJkuCzUUkm2SeEaTads8VfEecCh+ltXchdq6DovXJqzQAXuR2P9cxZB47Lg4klriA==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-config/-/metro-config-0.83.8.tgz",
"integrity": "sha512-crNbNy+/B4tCne2+HjUshwvC57gNBQj+V9fFSy3lHH2RlKcLHib3Mil/SfTX8Pfh2fCY5pPuSu2OKa7YiadB+Q==",
"license": "MIT",
"dependencies": {
"connect": "^3.6.5",
"flow-enums-runtime": "^0.0.6",
"jest-validate": "^29.7.0",
"metro": "0.83.3",
"metro-cache": "0.83.3",
"metro-core": "0.83.3",
"metro-runtime": "0.83.3",
"metro": "0.83.8",
"metro-cache": "0.83.8",
"metro-core": "0.83.8",
"metro-runtime": "0.83.8",
"yaml": "^2.6.1"
},
"engines": {
@ -8516,23 +8498,23 @@
}
},
"node_modules/metro-core": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-core/-/metro-core-0.83.3.tgz",
"integrity": "sha512-M+X59lm7oBmJZamc96usuF1kusd5YimqG/q97g4Ac7slnJ3YiGglW5CsOlicTR5EWf8MQFxxjDoB6ytTqRe8Hw==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-core/-/metro-core-0.83.8.tgz",
"integrity": "sha512-NTyOUOQaQKvQgJG9VI2ymN6KTM7gHEqkVFhkPc9bK4BsHSTz/EaXuFBXtC+wtwINLeH9tbusL/jfsSmdEmuU7A==",
"license": "MIT",
"dependencies": {
"flow-enums-runtime": "^0.0.6",
"lodash.throttle": "^4.1.1",
"metro-resolver": "0.83.3"
"metro-resolver": "0.83.8"
},
"engines": {
"node": ">=20.19.4"
}
},
"node_modules/metro-file-map": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-file-map/-/metro-file-map-0.83.3.tgz",
"integrity": "sha512-jg5AcyE0Q9Xbbu/4NAwwZkmQn7doJCKGW0SLeSJmzNB9Z24jBe0AL2PHNMy4eu0JiKtNWHz9IiONGZWq7hjVTA==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-file-map/-/metro-file-map-0.83.8.tgz",
"integrity": "sha512-+W++EUuzEXIfWQEFTWQMVThzhWbnJL4gRNJ9WSHzIAM5pT7gsprUxo9+2hrfirURm/TLvrKwhq37oCECJcDSyQ==",
"license": "MIT",
"dependencies": {
"debug": "^4.4.0",
@ -8550,9 +8532,9 @@
}
},
"node_modules/metro-minify-terser": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-minify-terser/-/metro-minify-terser-0.83.3.tgz",
"integrity": "sha512-O2BmfWj6FSfzBLrNCXt/rr2VYZdX5i6444QJU0fFoc7Ljg+Q+iqebwE3K0eTvkI6TRjELsXk1cjU+fXwAR4OjQ==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-minify-terser/-/metro-minify-terser-0.83.8.tgz",
"integrity": "sha512-7tU0J5/c7LZaZJwTlOb1xq0NepTFvGzRxigDhZOq4jSE6g0BRHmBqe7XvLH3WcRiJNGy+eshcZr34RpMjb6mmg==",
"license": "MIT",
"dependencies": {
"flow-enums-runtime": "^0.0.6",
@ -8563,9 +8545,9 @@
}
},
"node_modules/metro-resolver": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-resolver/-/metro-resolver-0.83.3.tgz",
"integrity": "sha512-0js+zwI5flFxb1ktmR///bxHYg7OLpRpWZlBBruYG8OKYxeMP7SV0xQ/o/hUelrEMdK4LJzqVtHAhBm25LVfAQ==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-resolver/-/metro-resolver-0.83.8.tgz",
"integrity": "sha512-piU0NVTI9i37YztDVF5rtn9uxP3NebVT0xZM9NKJ9z0jbigrctUQksi3NoYIeJMvL6Wn2dgAehpcmmnfn+gUwA==",
"license": "MIT",
"dependencies": {
"flow-enums-runtime": "^0.0.6"
@ -8575,9 +8557,9 @@
}
},
"node_modules/metro-runtime": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-runtime/-/metro-runtime-0.83.3.tgz",
"integrity": "sha512-JHCJb9ebr9rfJ+LcssFYA2x1qPYuSD/bbePupIGhpMrsla7RCwC/VL3yJ9cSU+nUhU4c9Ixxy8tBta+JbDeZWw==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-runtime/-/metro-runtime-0.83.8.tgz",
"integrity": "sha512-f7FfeM0pamq8vrvs8aO9KvIUabbUKe0WkHFpLt6Q9yIIIsORqNFwlgJeHGraOFPU7Cxqj5yLXkJu5bT1uwDXvw==",
"license": "MIT",
"dependencies": {
"@babel/runtime": "^7.25.0",
@ -8588,19 +8570,18 @@
}
},
"node_modules/metro-source-map": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-source-map/-/metro-source-map-0.83.3.tgz",
"integrity": "sha512-xkC3qwUBh2psVZgVavo8+r2C9Igkk3DibiOXSAht1aYRRcztEZNFtAMtfSB7sdO2iFMx2Mlyu++cBxz/fhdzQg==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-source-map/-/metro-source-map-0.83.8.tgz",
"integrity": "sha512-60Uor7bM+KsVewLkLCcZfkPFCbqjPDdoSmeBuT3+ye+ac80BuLWbbR8DpyxWpUqQeZPdaAT5ZqFgDIs8BNEcVA==",
"license": "MIT",
"dependencies": {
"@babel/traverse": "^7.25.3",
"@babel/traverse--for-generate-function-map": "npm:@babel/traverse@^7.25.3",
"@babel/types": "^7.25.2",
"@babel/traverse": "^7.29.0",
"@babel/types": "^7.29.0",
"flow-enums-runtime": "^0.0.6",
"invariant": "^2.2.4",
"metro-symbolicate": "0.83.3",
"metro-symbolicate": "0.83.8",
"nullthrows": "^1.1.1",
"ob1": "0.83.3",
"ob1": "0.83.8",
"source-map": "^0.5.6",
"vlq": "^1.0.0"
},
@ -8609,14 +8590,14 @@
}
},
"node_modules/metro-symbolicate": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-symbolicate/-/metro-symbolicate-0.83.3.tgz",
"integrity": "sha512-F/YChgKd6KbFK3eUR5HdUsfBqVsanf5lNTwFd4Ca7uuxnHgBC3kR/Hba/RGkenR3pZaGNp5Bu9ZqqP52Wyhomw==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-symbolicate/-/metro-symbolicate-0.83.8.tgz",
"integrity": "sha512-ZLrbqOqQ+m+Mpv7zo65XEXkNqVYvgUbY7tIsb9e1zSSmU/4C3D6DjaJvRHqcAdl0mkg8TI/csKooAEa5xcZNwg==",
"license": "MIT",
"dependencies": {
"flow-enums-runtime": "^0.0.6",
"invariant": "^2.2.4",
"metro-source-map": "0.83.3",
"metro-source-map": "0.83.8",
"nullthrows": "^1.1.1",
"source-map": "^0.5.6",
"vlq": "^1.0.0"
@ -8629,15 +8610,15 @@
}
},
"node_modules/metro-transform-plugins": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-transform-plugins/-/metro-transform-plugins-0.83.3.tgz",
"integrity": "sha512-eRGoKJU6jmqOakBMH5kUB7VitEWiNrDzBHpYbkBXW7C5fUGeOd2CyqrosEzbMK5VMiZYyOcNFEphvxk3OXey2A==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-transform-plugins/-/metro-transform-plugins-0.83.8.tgz",
"integrity": "sha512-9JRPkvi+m0QH2Y/w5RjCF9mHqOUNFpMFLDDLhKUjhcKESh8Wm3HKDdHXHVldTN1lTToCIabv81nF0zyJzKEJ5g==",
"license": "MIT",
"dependencies": {
"@babel/core": "^7.25.2",
"@babel/generator": "^7.25.0",
"@babel/template": "^7.25.0",
"@babel/traverse": "^7.25.3",
"@babel/generator": "^7.29.1",
"@babel/template": "^7.28.6",
"@babel/traverse": "^7.29.0",
"flow-enums-runtime": "^0.0.6",
"nullthrows": "^1.1.1"
},
@ -8646,42 +8627,96 @@
}
},
"node_modules/metro-transform-worker": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/metro-transform-worker/-/metro-transform-worker-0.83.3.tgz",
"integrity": "sha512-Ztekew9t/gOIMZX1tvJOgX7KlSLL5kWykl0Iwu2cL2vKMKVALRl1hysyhUw0vjpAvLFx+Kfq9VLjnHIkW32fPA==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/metro-transform-worker/-/metro-transform-worker-0.83.8.tgz",
"integrity": "sha512-Pa2hOfhUmWpI/dmkhsLq8uGyFHK2opoEK7j/YCiRtqNSe0YzzxYguXTNgg8AMiuZfc9LPcB1AhGENS10O5wcIw==",
"license": "MIT",
"dependencies": {
"@babel/core": "^7.25.2",
"@babel/generator": "^7.25.0",
"@babel/parser": "^7.25.3",
"@babel/types": "^7.25.2",
"@babel/generator": "^7.29.1",
"@babel/parser": "^7.29.0",
"@babel/types": "^7.29.0",
"flow-enums-runtime": "^0.0.6",
"metro": "0.83.3",
"metro-babel-transformer": "0.83.3",
"metro-cache": "0.83.3",
"metro-cache-key": "0.83.3",
"metro-minify-terser": "0.83.3",
"metro-source-map": "0.83.3",
"metro-transform-plugins": "0.83.3",
"metro": "0.83.8",
"metro-babel-transformer": "0.83.8",
"metro-cache": "0.83.8",
"metro-cache-key": "0.83.8",
"metro-minify-terser": "0.83.8",
"metro-source-map": "0.83.8",
"metro-transform-plugins": "0.83.8",
"nullthrows": "^1.1.1"
},
"engines": {
"node": ">=20.19.4"
}
},
"node_modules/metro/node_modules/accepts": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
"integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
"license": "MIT",
"dependencies": {
"mime-types": "^3.0.0",
"negotiator": "^1.0.0"
},
"engines": {
"node": ">= 0.6"
}
},
"node_modules/metro/node_modules/hermes-estree": {
"version": "0.32.0",
"resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.32.0.tgz",
"integrity": "sha512-KWn3BqnlDOl97Xe1Yviur6NbgIZ+IP+UVSpshlZWkq+EtoHg6/cwiDj/osP9PCEgFE15KBm1O55JRwbMEm5ejQ==",
"version": "0.35.0",
"resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.35.0.tgz",
"integrity": "sha512-xVx5Opwy8Oo1I5yGpVRhCvWL/iV3M+ylksSKVNlxxD90cpDpR/AR1jLYqK8HWihm065a6UI3HeyAmYzwS8NOOg==",
"license": "MIT"
},
"node_modules/metro/node_modules/hermes-parser": {
"version": "0.32.0",
"resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.32.0.tgz",
"integrity": "sha512-g4nBOWFpuiTqjR3LZdRxKUkij9iyveWeuks7INEsMX741f3r9xxrOe8TeQfUxtda0eXmiIFiMQzoeSQEno33Hw==",
"version": "0.35.0",
"resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.35.0.tgz",
"integrity": "sha512-9JLjeHxBx8T4CAsydZR49PNZUaix+WpQJwu9p2010lu+7Kwl6D/7wYFFJxoz+aXkaaClp9Zfg6W6/zVlSJORaA==",
"license": "MIT",
"dependencies": {
"hermes-estree": "0.32.0"
"hermes-estree": "0.35.0"
}
},
"node_modules/metro/node_modules/mime-db": {
"version": "1.54.0",
"resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
"integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
"license": "MIT",
"engines": {
"node": ">= 0.6"
}
},
"node_modules/metro/node_modules/mime-types": {
"version": "3.0.2",
"resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
"integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
"license": "MIT",
"dependencies": {
"mime-db": "^1.54.0"
},
"engines": {
"node": ">=18"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/metro/node_modules/negotiator": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
"integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
"license": "MIT",
"dependencies": {
"content-type": "^2.1.0"
},
"engines": {
"node": ">=18"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/metro/node_modules/ws": {
@ -8929,10 +8964,13 @@
"license": "MIT"
},
"node_modules/node-releases": {
"version": "2.0.27",
"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
"integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
"license": "MIT"
"version": "2.0.54",
"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
"integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
"license": "MIT",
"engines": {
"node": ">=18"
}
},
"node_modules/normalize-path": {
"version": "3.0.0",
@ -9001,9 +9039,9 @@
"license": "MIT"
},
"node_modules/ob1": {
"version": "0.83.3",
"resolved": "https://registry.npmjs.org/ob1/-/ob1-0.83.3.tgz",
"integrity": "sha512-egUxXCDwoWG06NGCS5s5AdcpnumHKJlfd3HH06P3m9TEMwwScfcY35wpQxbm9oHof+dM/lVH9Rfyu1elTVelSA==",
"version": "0.83.8",
"resolved": "https://registry.npmjs.org/ob1/-/ob1-0.83.8.tgz",
"integrity": "sha512-pk7el+eTOzfSKMAY4QBiiwKzegXn633JQj13y+pW5E5IdS+yV2CfDJ9Hf20K/LKy8nCrP9dAmd7XOk52OJxifA==",
"license": "MIT",
"dependencies": {
"flow-enums-runtime": "^0.0.6"
@ -9649,9 +9687,9 @@
}
},
"node_modules/postcss-selector-parser": {
"version": "6.1.2",
"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
"version": "6.1.4",
"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
"license": "MIT",
"dependencies": {
"cssesc": "^3.0.0",
@ -9796,15 +9834,6 @@
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/queue": {
"version": "6.0.2",
"resolved": "https://registry.npmjs.org/queue/-/queue-6.0.2.tgz",
"integrity": "sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==",
"license": "MIT",
"dependencies": {
"inherits": "~2.0.3"
}
},
"node_modules/queue-microtask": {
"version": "1.2.3",
"resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@ -10533,9 +10562,9 @@
}
},
"node_modules/react-native/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
@ -10953,9 +10982,9 @@
}
},
"node_modules/rimraf/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
@ -11259,9 +11288,9 @@
}
},
"node_modules/shell-quote": {
"version": "1.9.0",
"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
"integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
"version": "1.12.0",
"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz",
"integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
@ -11330,9 +11359,9 @@
}
},
"node_modules/source-map-js": {
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
"integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
"version": "1.2.2",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
"integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
"license": "BSD-3-Clause",
"engines": {
"node": ">=0.10.0"
@ -11679,9 +11708,9 @@
}
},
"node_modules/test-exclude/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
@ -11907,9 +11936,9 @@
}
},
"node_modules/undici": {
"version": "6.28.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
"integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
"version": "6.29.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
"integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
"license": "MIT",
"engines": {
"node": ">=18.17"
@ -11993,9 +12022,9 @@
}
},
"node_modules/update-browserslist-db": {
"version": "1.2.3",
"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
"integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
"version": "1.3.2",
"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
"integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
"funding": [
{
"type": "opencollective",

40
package.json
View file

@ -68,22 +68,27 @@
},
"overrides": {
"esbuild": "^0.25.0",
"@xmldom/xmldom": "^0.8.13",
"@xmldom/xmldom": "^0.8.15",
"uuid": "^11.1.1",
"postcss": "^8.5.18",
"js-yaml@^3.0.0": "^3.15.1",
"js-yaml@^4.0.0": "^4.3.1",
"brace-expansion@^1.0.0": "^1.1.18",
"brace-expansion@^2.0.0": "^2.1.4",
"brace-expansion@^5.0.0": "^5.0.9",
"postcss-selector-parser@^6.0.0": "^6.1.3",
"source-map-js@^1.0.0": "^1.2.2",
"http-cache-semantics@^4.0.0": "^4.3.0",
"js-yaml@^3.0.0": "^3.15.2",
"js-yaml@^4.0.0": "^4.3.2",
"brace-expansion@^1.0.0": "^1.1.21",
"brace-expansion@^2.0.0": "^2.1.7",
"brace-expansion@^5.0.0": "^5.0.12",
"@babel/core": "^7.29.6",
"browserslist": "^4.28.7",
"@expo/cli": {
"compression": "^1.8.2",
"ws": "^8.20.1",
"undici": "^6.28.0",
"undici": "^6.28.1",
"tar": "^7.5.21"
},
"react-devtools-core": {
"shell-quote": "^1.8.4",
"shell-quote": "^1.11.0",
"ws": "^7.5.11"
},
"react-native": {
@ -93,8 +98,23 @@
"ws": "^7.5.11"
},
"metro": {
"ws": "^7.5.11"
}
"ws": "^7.5.11",
".": "^0.83.8"
},
"metro-babel-transformer": "^0.83.8",
"metro-cache": "^0.83.8",
"metro-cache-key": "^0.83.8",
"metro-config": "^0.83.8",
"metro-core": "^0.83.8",
"metro-file-map": "^0.83.8",
"metro-minify-terser": "^0.83.8",
"metro-resolver": "^0.83.8",
"metro-runtime": "^0.83.8",
"metro-source-map": "^0.83.8",
"metro-symbolicate": "^0.83.8",
"metro-transform-plugins": "^0.83.8",
"metro-transform-worker": "^0.83.8",
"@react-navigation/core": "^7.22.1"
},
"private": true
}

248
tests/smoke.test.cjs
View file

@ -168,6 +168,254 @@ check('feedback.ts stays import-free (protects type-stripping test path)', () =>
);
});
// --- Build toolchain guards ---
// A blanket `npm audit fix` (PR #118) once rewrote hundreds of lock entries:
// babel-preset-expo and @expo/metro-config lost their root hoisting and a
// second Expo SDK was nested inside Expo 54. The tests stayed green while the
// first Metro bundle failed. These checks lock the layout the build relies on.
const ROOT = path.resolve(__dirname, '..');
const ROOT_NODE_MODULES = path.join(ROOT, 'node_modules');
function majorOf(version) {
return version.split('.')[0];
}
// Every installed copy of `name`, at the root and nested under other packages.
function installedCopies(name, dir = ROOT_NODE_MODULES, found = []) {
const pkgJson = path.join(dir, name, 'package.json');
if (fs.existsSync(pkgJson)) {
found.push({ dir: path.dirname(pkgJson), version: require(pkgJson).version });
}
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
const pkgDirs = entry.name.startsWith('@')
? fs.readdirSync(path.join(dir, entry.name)).map((n) => path.join(dir, entry.name, n))
: [path.join(dir, entry.name)];
for (const pkgDir of pkgDirs) {
const nested = path.join(pkgDir, 'node_modules');
if (fs.existsSync(nested)) installedCopies(name, nested, found);
}
}
return found;
}
// babel.config.js and sql-transformer.js require these from the repo root.
for (const request of ['babel-preset-expo', '@expo/metro-config/babel-transformer']) {
check(`${request} resolves from the repo root node_modules`, () => {
const resolved = require.resolve(request, { paths: [ROOT] });
const pkgName = request.startsWith('@')
? request.split('/').slice(0, 2).join('/')
: request.split('/')[0];
const expectedDir = path.join(ROOT_NODE_MODULES, pkgName) + path.sep;
assert.ok(
resolved.startsWith(expectedDir),
`${request} resolved to ${resolved}, expected under ${expectedDir}`
);
});
}
check('a single Expo SDK major is installed (matches package.json)', () => {
const pkg = require('../package.json');
const expected = majorOf(pkg.dependencies.expo.replace(/^[~^]/, ''));
const copies = installedCopies('expo');
assert.ok(copies.length > 0, 'expo is not installed');
const strays = copies.filter((c) => majorOf(c.version) !== expected);
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
`expected only expo ${expected}.x`
);
});
check('every installed metro copy honors the 0.83.x override pin', () => {
const copies = installedCopies('metro');
assert.ok(copies.length > 0, 'metro is not installed');
const strays = copies.filter((c) => !/^0\.83\./.test(c.version));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'metro must stay on 0.83.x'
);
});
// @react-navigation/core <= 7.22.0 pulls query-string -> decode-uri-component
// <= 0.4.2 (GHSA-vcc3-ghjq-m6fr). 7.22.1 parses queries itself, so the deep
// link round trip must still carry query params through.
// Scope: this covers @react-navigation/core's own linking helpers only. The
// app's deep links (simplliste://task/<id>) are resolved by expo-router's fork
// (expo-router/build/fork/getStateFromPath*.js), which still uses
// query-string@7 (see #120) and is not exercised here.
check('@react-navigation/core is >= 7.22.1 and drops query-string', () => {
const core = require('@react-navigation/core/package.json');
const [major, minor, patch] = core.version.split('.').map(Number);
assert.ok(
major > 7 || (major === 7 && (minor > 22 || (minor === 22 && patch >= 1))),
`@react-navigation/core ${core.version} is vulnerable`
);
assert.ok(!('query-string' in (core.dependencies || {})), 'core still depends on query-string');
});
check('@react-navigation/core deep link round trip keeps query params', () => {
const { getStateFromPath, getPathFromState } = require('@react-navigation/core');
const config = { screens: { Task: 'task/:id' } };
const state = getStateFromPath('/task/abc?x=1&y=a%20b', config);
assert.deepEqual(state.routes[0].params, { id: 'abc', x: '1', y: 'a b' });
assert.equal(getPathFromState(state, config), '/task/abc?x=1&y=a%20b');
});
// --- Override floors for build-tool transitive deps (#124, #125) ---
// brace-expansion is overridden per major (version-scoped): a blanket override
// forces one major onto every minimatch and breaks minimatch@3 (#103). The
// floors below are the patched head of each major; any other major is either
// vulnerable (4.x) or unexpected, and must fail loudly.
function versionAtLeast(version, floor) {
const a = version.split('.').map(Number);
const b = floor.split('.').map(Number);
for (let i = 0; i < 3; i++) {
if (a[i] !== b[i]) return a[i] > b[i];
}
return true;
}
const BRACE_EXPANSION_FLOORS = { 1: '1.1.21', 2: '2.1.7', 5: '5.0.12' };
check('every installed brace-expansion copy is at or above its major floor', () => {
const copies = installedCopies('brace-expansion');
assert.ok(copies.length > 0, 'brace-expansion is not installed');
const strays = copies.filter((c) => {
const floor = BRACE_EXPANSION_FLOORS[majorOf(c.version)];
return !floor || !versionAtLeast(c.version, floor);
});
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
`expected floors ${JSON.stringify(BRACE_EXPANSION_FLOORS)}`
);
});
check('every installed undici copy is >= 6.28.1', () => {
const copies = installedCopies('undici');
assert.ok(copies.length > 0, 'undici is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '6.28.1'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'undici must be >= 6.28.1'
);
});
// --- Override floors (#128, #129) ---
// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got).
// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
// any other major is unexpected and must fail loudly.
check('every installed http-cache-semantics copy is >= 4.3.0', () => {
const copies = installedCopies('http-cache-semantics');
assert.ok(copies.length > 0, 'http-cache-semantics is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '4.3.0'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'http-cache-semantics must be >= 4.3.0'
);
});
check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () => {
const copies = installedCopies('postcss-selector-parser');
assert.ok(copies.length > 0, 'postcss-selector-parser is not installed');
const strays = copies.filter(
(c) => majorOf(c.version) !== '6' || !versionAtLeast(c.version, '6.1.3')
);
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'postcss-selector-parser must be 6.x >= 6.1.3'
);
});
// --- Override floors (#133, #134, #135) ---
// shell-quote: scoped to react-devtools-core (raised from #95's ^1.8.4).
// compression: scoped to @expo/cli (dev server middleware).
// source-map-js: version-scoped to major 1 (postcss, tailwindcss pipeline).
// Each floor is paired with a call to the API its consumer actually uses.
check('every installed shell-quote copy is >= 1.11.0 and still quotes/parses', () => {
const copies = installedCopies('shell-quote');
assert.ok(copies.length > 0, 'shell-quote is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '1.11.0'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'shell-quote must be >= 1.11.0'
);
for (const c of copies) {
const { quote, parse } = require(c.dir);
const where = `shell-quote ${c.version} at ${path.relative(ROOT, c.dir)}`;
assert.equal(quote(['code', '-g', 'a b.js:1']), "code -g 'a b.js:1'", `${where}: quote`);
assert.deepEqual(parse('a "b c" d'), ['a', 'b c', 'd'], `${where}: parse`);
}
});
check('every installed compression copy is >= 1.8.2 and builds a middleware', () => {
const copies = installedCopies('compression');
assert.ok(copies.length > 0, 'compression is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '1.8.2'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'compression must be >= 1.8.2'
);
for (const c of copies) {
const middleware = require(c.dir)();
assert.equal(typeof middleware, 'function', `compression ${c.version}: middleware`);
assert.equal(middleware.length, 3, `compression ${c.version}: (req, res, next) signature`);
}
});
check('every installed source-map-js copy is 1.x >= 1.2.2 and round-trips a mapping', () => {
const copies = installedCopies('source-map-js');
assert.ok(copies.length > 0, 'source-map-js is not installed');
const strays = copies.filter(
(c) => majorOf(c.version) !== '1' || !versionAtLeast(c.version, '1.2.2')
);
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'source-map-js must be 1.x >= 1.2.2'
);
for (const c of copies) {
const { SourceMapGenerator, SourceMapConsumer } = require(c.dir);
const gen = new SourceMapGenerator({ file: 'out.css' });
gen.addMapping({
source: 'in.css',
original: { line: 3, column: 2 },
generated: { line: 1, column: 0 },
});
const pos = new SourceMapConsumer(gen.toJSON()).originalPositionFor({ line: 1, column: 0 });
const where = `source-map-js ${c.version} at ${path.relative(ROOT, c.dir)}`;
assert.deepEqual([pos.source, pos.line, pos.column], ['in.css', 3, 2], where);
}
});
// The call that broke under the blanket override: each minimatch copy must
// still expand braces through its own brace-expansion major.
check('every installed minimatch copy still matches globs and braces', () => {
const copies = installedCopies('minimatch');
const majors = [...new Set(copies.map((c) => majorOf(c.version)))].sort();
assert.deepEqual(majors, ['10', '3', '9'], 'expected minimatch majors 3, 9 and 10');
for (const c of copies) {
const mod = require(c.dir);
const minimatch = mod.minimatch || mod; // v3 exports the function itself
const where = `minimatch ${c.version} at ${path.relative(ROOT, c.dir)}`;
assert.equal(minimatch('foo/bar.js', '**/*.js'), true, `${where}: globstar`);
assert.equal(minimatch('a/b.js', 'a/{b,c}.js'), true, `${where}: brace match`);
assert.equal(minimatch('a/d.js', 'a/{b,c}.js'), false, `${where}: brace miss`);
assert.equal(minimatch('f3.js', 'f{1..3}.js'), true, `${where}: numeric range`);
}
});
if (failed === 0) {
console.log('\nsmoke OK');
process.exit(0);