fix(security): add http-cache-semantics and postcss-selector-parser floors #131

Merged

maximus merged 2 commits from issue-128-129-http-cache-semantics-postcss-selector-parser-floors into master 2026-10-05 23:34:42 +00:00

Conversation 2 Commits 2 Files changed 3 +37 -6

2 commits

Author	SHA1	Message	Date
le king fu	cb53a43422	fix(security): scope http-cache-semantics floor to major 4 ... Review follow-up on #131: a blanket override would force any future 5.x consumer down to 4.x. The version-scoped key keeps the floor within the current major, like postcss-selector-parser. No lockfile change. Refs #128 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 19:34:25 -04:00
le king fu	62efdba22e	fix(security): add http-cache-semantics and postcss-selector-parser floors ... - http-cache-semantics ^4.3.0 (GHSA-ch52-4w7c-c8xp, high): 4.3.0 is out of the <=4.2.0 range although the advisory lists no patched version. Single copy via @expo/ngrok > got > cacheable-request (^4.0.0), dev tunnel only. - postcss-selector-parser@^6.0.0 -> ^6.1.3 (GHSA-w9m9-85wc-3x92, low), version-scoped to the tailwindcss@3 major. Resolves to 6.1.4. Lockfile: two stanzas, package count unchanged (2084). npm audit 33 -> 31. Android JS bundle (expo export --no-bytecode, cache cleared) is byte-identical before and after. Smoke test guards both floors. Resolves #128 Resolves #129 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 19:27:33 -04:00