fix(security): raise @xmldom/xmldom and js-yaml override floors #122

Merged

maximus merged 1 commit from issue-121-xmldom-js-yaml-floors into master

2026-09-26 00:27:55 +00:00

maximus commented

2026-09-26 00:10:08 +00:00

Owner

Fixes #121

Change

Override floors raised in package.json:

@xmldom/xmldom: ^0.8.13 -> ^0.8.15
js-yaml@^3.0.0: ^3.15.1 -> ^3.15.2
js-yaml@^4.0.0: ^4.3.1 -> ^4.3.2

Lock diff: exactly 3 entries (node_modules/@xmldom/xmldom, node_modules/js-yaml, node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml), version/resolved/integrity only.

Verification

npm audit: 6 (1 low, 3 moderate, 2 high) -> 4 (1 low, 3 moderate, 0 high). No new advisory. Remaining: expo-router -> query-string -> decode-uri-component chain (#120, blocked on SDK upgrade) and postcss-selector-parser (low).
Real consumers exercised in node: @expo/plist parse/build, plist.parse (via simple-plist), js-yaml load with merge keys through @expo/xcpretty (4.3.2) and @istanbuljs/load-nyc-config (3.15.2).
npm test: smoke OK (toolchain guards included), feedback 11/11.
npx expo export --platform android: OK, Hermes bundle hash identical to master (index-da76a487...hbc) -> nothing changes in the app.

No test logic added: pure floor bump, same pattern as #115; the version floors are covered by npm audit / Defenseur.

🤖 Generated with Claude Code

Fixes #121 ## Change Override floors raised in `package.json`: - `@xmldom/xmldom`: `^0.8.13` -> `^0.8.15` - `js-yaml@^3.0.0`: `^3.15.1` -> `^3.15.2` - `js-yaml@^4.0.0`: `^4.3.1` -> `^4.3.2` Lock diff: exactly 3 entries (`node_modules/@xmldom/xmldom`, `node_modules/js-yaml`, `node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml`), version/resolved/integrity only. ## Verification - `npm audit`: 6 (1 low, 3 moderate, **2 high**) -> 4 (1 low, 3 moderate, **0 high**). No new advisory. Remaining: `expo-router` -> `query-string` -> `decode-uri-component` chain (#120, blocked on SDK upgrade) and `postcss-selector-parser` (low). - Real consumers exercised in node: `@expo/plist` parse/build, `plist.parse` (via `simple-plist`), `js-yaml` load with merge keys through `@expo/xcpretty` (4.3.2) and `@istanbuljs/load-nyc-config` (3.15.2). - `npm test`: smoke OK (toolchain guards included), feedback 11/11. - `npx expo export --platform android`: OK, Hermes bundle hash identical to master (`index-da76a487...hbc`) -> nothing changes in the app. No test logic added: pure floor bump, same pattern as #115; the version floors are covered by `npm audit` / Defenseur. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

maximus added 1 commit 2026-09-26 00:10:09 +00:00

fix(security): raise @xmldom/xmldom and js-yaml override floors 100078e1e2

Advisories published on 2026-09-08 land above the current floors:
- @xmldom/xmldom <= 0.8.14 (GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4,
  GHSA-93r5-fhx6-vmg9 and 7 more), patched in 0.8.15 (lts line)
- js-yaml < 3.15.2 / < 4.3.2 (GHSA-2883-xcg3-v3hh)

Raise the three overrides. Lock diff is limited to the three entries.
All consumers are build-time tooling (@expo/plist, plist via xcode,
@expo/xcpretty, @istanbuljs/load-nyc-config); the Android bundle hash
is unchanged.

Fixes #121

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

maximus added the

source:human

status:review

type:security

labels 2026-09-26 00:10:09 +00:00

maximus commented

2026-09-26 00:25:17 +00:00

Author

Owner

Review — APPROVE

Summary: Pure override floor bump (@xmldom/xmldom ^0.8.15, js-yaml ^3.15.2 / ^4.3.2). The lock diff is limited to the 3 expected entries (version/resolved/integrity), and the high advisories are gone.

Independent verification

Mutation (master lockfile, copied outside the repo): npm audit --package-lock-only → 6 vulns (2 high: @xmldom/xmldom, js-yaml). On the branch: 4 (1 low, 3 moderate, 0 high). Remaining findings are exactly expo-router → query-string → decode-uri-component (#120) and postcss-selector-parser, as stated.
npm ls --all exit 0 (tree consistent with the lock); resolved versions: js-yaml@4.3.2, js-yaml@3.15.2 (nested @istanbuljs/load-nyc-config), @xmldom/xmldom@0.8.15 (deduped).
Diff: 2 files, 12+/12-, no stray artifacts. Commit fix(security): ... in conventional format, Fixes #121 in the commit message.

Checklist

Security: no secrets, no .env files. Consumers are build-time only (plist/xcode/xcpretty/istanbul); the reported identical Hermes bundle hash is consistent with that.
Tests: no test logic is expected for a floor bump. npm audit / the Defenseur act as the regression guard, following the same pattern as #115.
Data: no migrations touched.

Suggestions (non-blocking)

None.

🤖 Generated with Claude Code

## Review — APPROVE **Summary**: Pure override floor bump (`@xmldom/xmldom` ^0.8.15, `js-yaml` ^3.15.2 / ^4.3.2). The lock diff is limited to the 3 expected entries (version/resolved/integrity), and the high advisories are gone. ### Independent verification - **Mutation (master lockfile, copied outside the repo)**: `npm audit --package-lock-only` → 6 vulns (**2 high**: `@xmldom/xmldom`, `js-yaml`). On the branch: 4 (1 low, 3 moderate, **0 high**). Remaining findings are exactly `expo-router` → `query-string` → `decode-uri-component` (#120) and `postcss-selector-parser`, as stated. - `npm ls --all` exit 0 (tree consistent with the lock); resolved versions: `js-yaml@4.3.2`, `js-yaml@3.15.2` (nested `@istanbuljs/load-nyc-config`), `@xmldom/xmldom@0.8.15` (deduped). - Diff: 2 files, 12+/12-, no stray artifacts. Commit `fix(security): ...` in conventional format, `Fixes #121` in the commit message. ### Checklist - Security: no secrets, no `.env` files. Consumers are build-time only (plist/xcode/xcpretty/istanbul); the reported identical Hermes bundle hash is consistent with that. - Tests: no test logic is expected for a floor bump. `npm audit` / the Defenseur act as the regression guard, following the same pattern as #115. - Data: no migrations touched. ### Suggestions (non-blocking) - None. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

maximus merged commit 4c2fe06f68 into master

2026-09-26 00:27:55 +00:00

maximus referenced this pull request from a commit

2026-09-26 00:27:57 +00:00

Merge pull request 'fix(security): raise @xmldom/xmldom and js-yaml override floors' (#122) from issue-121-xmldom-js-yaml-floors into master

No reviewers