fix(security): raise shell-quote, add compression and source-map-js floors #138

Merged

maximus merged 1 commit from issue-133-134-135-shell-quote-compression-source-map-js into master

2026-10-06 23:12:32 +00:00

maximus commented

2026-10-06 23:08:08 +00:00

Owner

Fixes #133
Fixes #134
Fixes #135

Changes

Three override floors, build and dev tooling only (nothing ships in the APK):

Issue	Package	Advisory	Override	Resolved
#133	shell-quote (critical)	GHSA-pqg4-j6r4-53mv	`react-devtools-core > shell-quote` ^1.8.4 -> ^1.11.0 (raises the #95 floor)	1.9.0 -> 1.12.0
#134	compression (high)	GHSA-vc2v-76pw-4v95	`@expo/cli > compression` ^1.8.2 (new, scoped)	1.8.1 -> 1.8.2
#135	source-map-js (high)	GHSA-68fv-2mgg-jv7q	`source-map-js@^1.0.0` -> ^1.2.2 (version-scoped)	1.2.1 -> 1.2.2

All three stay inside the range their parent declares (^1.6.1, ^1.7.4, ^1.2.1): no major crossed.

Evidence

Lock: only the three package entries change (version, resolved, integrity; compression 1.8.2 declares destroy, already in the tree). .packages key set identical before/after.
Smoke test: new guards (version floor plus a call to the API the consumer uses: quote/parse, middleware factory, SourceMapGenerator/Consumer round trip).
- Before (vulnerable tree): smoke FAIL (3 failures), i.e. 1.9.0, 1.8.1, 1.2.1
- After: smoke OK, npm test 11/11
npm audit: 43 -> 40 (high 30 -> 28, critical 1 -> 0). None of the three packages listed anymore. The remaining 40 come from the floors tracked in #123, #130, #136, #137 and the accepted #120, plus their transitive inflation.
Deliverable (#135, CSS pipeline): npx expo export --platform android --no-bytecode --clear before/after, 44 files byte-identical, JS bundle included (same hashed name).
Dev server (#134): expo start -> /status = packager-status:running; Android bundle served HTTP 200, Content-Encoding: gzip (2.57 MB). Server stopped afterwards, port 8081 freed.
Clean-room npm ci (npm 10.9.4) on a copy: installs without rewriting the lock; npm ls shows shell-quote 1.12.0, compression 1.8.2, source-map-js 1.2.2, no invalid/missing.

npm ls shell-quote     -> react-native > react-devtools-core@6.1.5 > shell-quote@1.12.0
npm ls compression     -> expo > @expo/cli@54.0.24 > compression@1.8.2
npm ls source-map-js   -> tailwindcss > postcss@8.5.26 > source-map-js@1.2.2

🤖 Generated with Claude Code

Fixes #133 Fixes #134 Fixes #135 ## Changes Three override floors, build and dev tooling only (nothing ships in the APK): | Issue | Package | Advisory | Override | Resolved | |---|---|---|---|---| | #133 | shell-quote (critical) | GHSA-pqg4-j6r4-53mv | `react-devtools-core > shell-quote` ^1.8.4 -> ^1.11.0 (raises the #95 floor) | 1.9.0 -> 1.12.0 | | #134 | compression (high) | GHSA-vc2v-76pw-4v95 | `@expo/cli > compression` ^1.8.2 (new, scoped) | 1.8.1 -> 1.8.2 | | #135 | source-map-js (high) | GHSA-68fv-2mgg-jv7q | `source-map-js@^1.0.0` -> ^1.2.2 (version-scoped) | 1.2.1 -> 1.2.2 | All three stay inside the range their parent declares (`^1.6.1`, `^1.7.4`, `^1.2.1`): no major crossed. ## Evidence - **Lock**: only the three package entries change (version, resolved, integrity; compression 1.8.2 declares `destroy`, already in the tree). `.packages` key set identical before/after. - **Smoke test**: new guards (version floor plus a call to the API the consumer uses: `quote`/`parse`, middleware factory, SourceMapGenerator/Consumer round trip). - Before (vulnerable tree): `smoke FAIL (3 failures)`, i.e. 1.9.0, 1.8.1, 1.2.1 - After: `smoke OK`, `npm test` 11/11 - **npm audit**: 43 -> 40 (high 30 -> 28, critical 1 -> 0). None of the three packages listed anymore. The remaining 40 come from the floors tracked in #123, #130, #136, #137 and the accepted #120, plus their transitive inflation. - **Deliverable (#135, CSS pipeline)**: `npx expo export --platform android --no-bytecode --clear` before/after, **44 files byte-identical**, JS bundle included (same hashed name). - **Dev server (#134)**: `expo start` -> `/status` = `packager-status:running`; Android bundle served `HTTP 200`, `Content-Encoding: gzip` (2.57 MB). Server stopped afterwards, port 8081 freed. - **Clean-room `npm ci`** (npm 10.9.4) on a copy: installs without rewriting the lock; `npm ls` shows shell-quote 1.12.0, compression 1.8.2, source-map-js 1.2.2, no invalid/missing. ``` npm ls shell-quote -> react-native > react-devtools-core@6.1.5 > shell-quote@1.12.0 npm ls compression -> expo > @expo/cli@54.0.24 > compression@1.8.2 npm ls source-map-js -> tailwindcss > postcss@8.5.26 > source-map-js@1.2.2 ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

maximus added 1 commit 2026-10-06 23:08:08 +00:00

fix(security): raise shell-quote, add compression and source-map-js floors 8b27054be9

- react-devtools-core > shell-quote ^1.8.4 -> ^1.11.0 (GHSA-pqg4-j6r4-53mv,
  critical, quote() command injection; resolves 1.12.0). Raises the #95 floor.
- @expo/cli > compression ^1.8.2 (GHSA-vc2v-76pw-4v95, high, dev server DoS).
- source-map-js@^1.0.0 -> ^1.2.2 (GHSA-68fv-2mgg-jv7q, high, postcss pipeline).

Lock: only the three package entries change, package key set identical.
Smoke test: floor guard plus a call to the consumed API for each package.
Export bundle byte-identical before/after (44 files). npm audit 43 -> 40,
critical 0. Build and dev tooling only, nothing ships in the APK.

Fixes #133
Fixes #134
Fixes #135

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

maximus commented

2026-10-06 23:10:24 +00:00

Author

Owner

Verdict : APPROVE

Trois planchers d'override (outillage build/dev, rien dans l'APK), chacun dans la plage declaree par son parent, avec un garde smoke par paquet qui couple la version minimale a un appel de l'API consommee.

Verifie en local (tete `8b27054`)

npm ls : shell-quote 1.12.0 (react-devtools-core, parent ^1.6.1), compression 1.8.2 (@expo/cli), source-map-js 1.2.2 (postcss, parent ^1.2.1). Aucun majeur franchi.
npm test : smoke OK, 11/11 feedback.
npm audit : 40 (12 moderate, 28 high, 0 critical) ; aucun des trois paquets n'apparait plus.
Lock : seules les trois entrees bougent ; destroy@1.2.0 (nouvelle dep de compression 1.8.2) est deja dans l'arbre.
Mutation du relecteur (copie hors depot) : les trois nouveaux gardes, executes contre un node_modules contenant les versions vulnerables reelles (shell-quote 1.9.0, compression 1.8.1, source-map-js 1.2.1) -> 3 FAIL sur 3, smoke FAIL (3 failures). Les memes gardes passent sur l'arbre de la PR. Copie supprimee.
Timeline : #133, #134, #135 portent chacune un pull_ref closes depuis cette PR.
Commit au format conventionnel.

Suggestions (non bloquantes)

L'override compression est scope a @expo/cli. Si un autre parent tire un jour compression < 1.8.2, l'override ne le couvrira pas, mais le garde smoke (qui parcourt toutes les copies) le signalera. Rien a changer, a garder en tete.

Rien de bloquant.

## Verdict : APPROVE Trois planchers d'override (outillage build/dev, rien dans l'APK), chacun dans la plage declaree par son parent, avec un garde smoke par paquet qui couple la version minimale a un appel de l'API consommee. ### Verifie en local (tete `8b27054`) - `npm ls` : shell-quote 1.12.0 (react-devtools-core, parent `^1.6.1`), compression 1.8.2 (@expo/cli), source-map-js 1.2.2 (postcss, parent `^1.2.1`). Aucun majeur franchi. - `npm test` : `smoke OK`, 11/11 feedback. - `npm audit` : 40 (12 moderate, 28 high, 0 critical) ; aucun des trois paquets n'apparait plus. - Lock : seules les trois entrees bougent ; `destroy@1.2.0` (nouvelle dep de compression 1.8.2) est deja dans l'arbre. - **Mutation du relecteur** (copie hors depot) : les trois nouveaux gardes, executes contre un `node_modules` contenant les versions vulnerables reelles (shell-quote 1.9.0, compression 1.8.1, source-map-js 1.2.1) -> **3 FAIL sur 3**, `smoke FAIL (3 failures)`. Les memes gardes passent sur l'arbre de la PR. Copie supprimee. - Timeline : #133, #134, #135 portent chacune un `pull_ref` `closes` depuis cette PR. - Commit au format conventionnel. ### Suggestions (non bloquantes) - L'override compression est scope a `@expo/cli`. Si un autre parent tire un jour compression < 1.8.2, l'override ne le couvrira pas, mais le garde smoke (qui parcourt toutes les copies) le signalera. Rien a changer, a garder en tete. Rien de bloquant.