- @expo/cli > undici ^6.27.0 -> ^6.28.0: GHSA-8xcm-r25x-g524 / m8rv-5g2x-5cg5
/ v3r7-h72x-cjcm (response desync, CRLF & cookie injection; vulnerable <6.28.0)
- js-yaml -> ^3.15.1 (3.x) + ^4.3.1 (4.x): CVE-2026-59870 / GHSA-5p4m-2wfm-xmqj
(quadratic CPU in !!omap resolution; vulnerable 3.x<3.15.1, 4.x<4.3.1)
js-yaml moved from parent-scoped overrides (@expo/xcpretty,
@istanbuljs/load-nyc-config) to version-scoped ones (js-yaml@^3 / js-yaml@^4):
the 4.x instance is reached via @expo/cli, which is itself overridden, and a
nested override does not propagate through an overridden parent (npm left
js-yaml@4.3.0 "invalid"). Version-scoped targeting resolves it regardless of
the parent path.
Both build/dev-time only, not bundled in the shipped APK. npm audit drops
undici + js-yaml (16 -> 14). Remaining 13 high = image-size + its metro/RN
cascade (upstream-locked, tracked in #108) + @babel/core low. Smoke test green,
widget patch reapplied, lock diff limited to the 3 bumped packages.
Fixes#106Fixes#107
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
