- brace-expansion -> ^1.1.18 / ^2.1.4 / ^5.0.9 (version-scoped per major):
DoS advisories (exponential-time expansion + unbounded OOM). Version-scoping
bumps each major within its own major, preserving the CJS export contract
(default export for 1.x/2.x, named for 5.x) that a blanket override would have
broken. This is #103's original blocker, now resolved. Verified: minimatch@3
glob resolution works (the exact call that TypeError'd under a blanket).
- @babel/core -> ^7.29.6 (resolves 7.29.7): GHSA-4x5r-pxfx-6jf8 arbitrary file
read via sourceMappingURL (vulnerable <=7.29.0, ~87 deduped instances).
Both build/dev-time only, not bundled in the shipped APK. npm audit 14 -> 12;
the remaining 12 high are entirely the image-size upstream-locked cascade
(no published fix, tracked in #108). Smoke test 11/11, lock diff is 1:1 version
replacements (large count driven by @babel/core's deduped instances).
Fixes#103Fixes#110
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
