fix(security): override @xmldom/xmldom to ^0.8.13 (#74) #77

Merged

maximus merged 1 commit from fix/vuln-A-xmldom-override into master

2026-04-24 18:13:57 +00:00

maximus commented

2026-04-24 11:13:56 +00:00

Owner

Closes #74

Generated autonomously by /autopilot run of 2026-04-24

Summary

Ajoute un override @xmldom/xmldom: ^0.8.13 dans package.json pour corriger 4 CVE HIGH dans la chaine Expo CLI / xcode.

CVE corrigees

CVE	Description
GHSA-2v35-w6hq-6mfw	DoS — uncontrolled recursion in XML serialization
GHSA-f6ww-3ggp-fr8h	XML injection via DOCTYPE serialization
GHSA-x6wf-f3px-wcqx	XML injection via processing instruction serialization
GHSA-j759-j44w-7fr8	XML injection via comment serialization

Verification

package.json contient lentree dans overrides
npm ls @xmldom/xmldom → 0.8.13 overridden dans toutes les chaines
npx tsc --noEmit passe sans erreur
npm audit --json | jq .vulnerabilities["@xmldom/xmldom"] retourne null
package-lock.json regenere et commit dans le meme commit
Metro bundler demarre sans crash (timeout 15s ok)

Decisions (autopilot)

[HIGH] Override ^0.8.13 et pas ^0.9.0 : API compatible, evite le strict parser. Decision prise ce soir (D4).
[HIGH] Pas de bump version/versionCode : smoke test, pas de distribution (D8).
[HIGH] Skip npm start interactif : tsc + install suffisants, xmldom est build-time only. Metro timeout 15s valide le bundler.

Closes #74 Generated autonomously by /autopilot run of 2026-04-24 ## Summary Ajoute un override `@xmldom/xmldom: ^0.8.13` dans `package.json` pour corriger 4 CVE HIGH dans la chaine Expo CLI / xcode. ## CVE corrigees | CVE | Description | |---|---| | GHSA-2v35-w6hq-6mfw | DoS — uncontrolled recursion in XML serialization | | GHSA-f6ww-3ggp-fr8h | XML injection via DOCTYPE serialization | | GHSA-x6wf-f3px-wcqx | XML injection via processing instruction serialization | | GHSA-j759-j44w-7fr8 | XML injection via comment serialization | ## Verification - [x] `package.json` contient lentree dans `overrides` - [x] `npm ls @xmldom/xmldom` → `0.8.13 overridden` dans toutes les chaines - [x] `npx tsc --noEmit` passe sans erreur - [x] `npm audit --json | jq .vulnerabilities["@xmldom/xmldom"]` retourne `null` - [x] `package-lock.json` regenere et commit dans le meme commit - [x] Metro bundler demarre sans crash (timeout 15s ok) ## Decisions (autopilot) - [HIGH] Override `^0.8.13` et pas `^0.9.0` : API compatible, evite le strict parser. Decision prise ce soir (D4). - [HIGH] Pas de bump version/versionCode : smoke test, pas de distribution (D8). - [HIGH] Skip npm start interactif : tsc + install suffisants, xmldom est build-time only. Metro timeout 15s valide le bundler.

maximus added 1 commit 2026-04-24 11:13:57 +00:00

fix(security): override @xmldom/xmldom to ^0.8.13 5842a686b2

Resolves 4 HIGH CVE in the xmldom transitive dep chain (Expo CLI + xcode/plist).
Not runtime-exploitable in APK (build-time deps only) but cleaned for audit hygiene.

- GHSA-2v35-w6hq-6mfw (DoS — uncontrolled recursion in XML serialization)
- GHSA-f6ww-3ggp-fr8h (XML injection via DOCTYPE serialization)
- GHSA-x6wf-f3px-wcqx (XML injection via processing instruction serialization)
- GHSA-j759-j44w-7fr8 (XML injection via comment serialization)

Refs #74

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>