fix(security): raise @xmldom/xmldom and js-yaml override floors #122

Merged

maximus merged 1 commit from issue-121-xmldom-js-yaml-floors into master

2026-09-26 00:27:55 +00:00

Author	SHA1	Message	Date
le king fu	100078e1e2	fix(security): raise @xmldom/xmldom and js-yaml override floors Advisories published on 2026-09-08 land above the current floors: - @xmldom/xmldom <= 0.8.14 (GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4, GHSA-93r5-fhx6-vmg9 and 7 more), patched in 0.8.15 (lts line) - js-yaml < 3.15.2 / < 4.3.2 (GHSA-2883-xcg3-v3hh) Raise the three overrides. Lock diff is limited to the three entries. All consumers are build-time tooling (@expo/plist, plist via xcode, @expo/xcpretty, @istanbuljs/load-nyc-config); the Android bundle hash is unchanged. Fixes #121 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 20:10:07 -04:00

Author

SHA1

Message

Date

le king fu

100078e1e2

fix(security): raise @xmldom/xmldom and js-yaml override floors

Advisories published on 2026-09-08 land above the current floors:
- @xmldom/xmldom <= 0.8.14 (GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4,
  GHSA-93r5-fhx6-vmg9 and 7 more), patched in 0.8.15 (lts line)
- js-yaml < 3.15.2 / < 4.3.2 (GHSA-2883-xcg3-v3hh)

Raise the three overrides. Lock diff is limited to the three entries.
All consumers are build-time tooling (@expo/plist, plist via xcode,
@expo/xcpretty, @istanbuljs/load-nyc-config); the Android bundle hash
is unchanged.

Fixes #121

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-25 20:10:07 -04:00