fix(security): raise shell-quote, add compression and source-map-js floors #138

Merged

maximus merged 1 commit from issue-133-134-135-shell-quote-compression-source-map-js into master

2026-10-06 23:12:32 +00:00

Author	SHA1	Message	Date
le king fu	8b27054be9	fix(security): raise shell-quote, add compression and source-map-js floors - react-devtools-core > shell-quote ^1.8.4 -> ^1.11.0 (GHSA-pqg4-j6r4-53mv, critical, quote() command injection; resolves 1.12.0). Raises the #95 floor. - @expo/cli > compression ^1.8.2 (GHSA-vc2v-76pw-4v95, high, dev server DoS). - source-map-js@^1.0.0 -> ^1.2.2 (GHSA-68fv-2mgg-jv7q, high, postcss pipeline). Lock: only the three package entries change, package key set identical. Smoke test: floor guard plus a call to the consumed API for each package. Export bundle byte-identical before/after (44 files). npm audit 43 -> 40, critical 0. Build and dev tooling only, nothing ships in the APK. Fixes #133 Fixes #134 Fixes #135 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:07:48 -04:00

Author

SHA1

Message

Date

le king fu

8b27054be9

fix(security): raise shell-quote, add compression and source-map-js floors

- react-devtools-core > shell-quote ^1.8.4 -> ^1.11.0 (GHSA-pqg4-j6r4-53mv,
  critical, quote() command injection; resolves 1.12.0). Raises the #95 floor.
- @expo/cli > compression ^1.8.2 (GHSA-vc2v-76pw-4v95, high, dev server DoS).
- source-map-js@^1.0.0 -> ^1.2.2 (GHSA-68fv-2mgg-jv7q, high, postcss pipeline).

Lock: only the three package entries change, package key set identical.
Smoke test: floor guard plus a call to the consumed API for each package.
Export bundle byte-identical before/after (44 files). npm audit 43 -> 40,
critical 0. Build and dev tooling only, nothing ships in the APK.

Fixes #133
Fixes #134
Fixes #135

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 19:07:48 -04:00