fix(security): bump postcss + @expo/cli tar overrides to patched versions #105

Merged

maximus merged 1 commit from issue-102-104-deps-overrides into master

2026-08-11 13:26:31 +00:00

Author	SHA1	Message	Date
le king fu	9eaa103a87	fix(security): bump postcss + @expo/cli tar overrides to patched versions - postcss ^8.5.10 -> ^8.5.18 (resolves to 8.5.26): GHSA-r28c-9q8g-f849, path traversal in source-map auto-loading (vulnerable <=8.5.17) - @expo/cli > tar ^7.5.19 -> ^7.5.21 (resolves to 7.5.22): GHSA-r292-9mhp-454m, uncontrolled recursion stack-overflow DoS (vulnerable <=7.5.20) - nanoid 3.3.11 -> 3.3.18 pulled in by postcss re-resolution (bonus) Both are build/dev-time only, not bundled in the shipped APK. npm audit no longer lists postcss (nor its transitive inflation expo/@expo/cli/ @expo/metro-config) nor tar. Smoke test green (11/11), widget patch-package reapplied, diff limited to package.json + package-lock.json. Fixes #102 Fixes #104 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-08-10 08:28:47 -04:00

Author

SHA1

Message

Date

le king fu

9eaa103a87

fix(security): bump postcss + @expo/cli tar overrides to patched versions

- postcss ^8.5.10 -> ^8.5.18 (resolves to 8.5.26): GHSA-r28c-9q8g-f849,
  path traversal in source-map auto-loading (vulnerable <=8.5.17)
- @expo/cli > tar ^7.5.19 -> ^7.5.21 (resolves to 7.5.22): GHSA-r292-9mhp-454m,
  uncontrolled recursion stack-overflow DoS (vulnerable <=7.5.20)
- nanoid 3.3.11 -> 3.3.18 pulled in by postcss re-resolution (bonus)

Both are build/dev-time only, not bundled in the shipped APK. npm audit no
longer lists postcss (nor its transitive inflation expo/@expo/cli/
@expo/metro-config) nor tar. Smoke test green (11/11), widget patch-package
reapplied, diff limited to package.json + package-lock.json.

Fixes #102
Fixes #104

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-10 08:28:47 -04:00