- react-devtools-core > shell-quote ^1.8.4 -> ^1.11.0 (GHSA-pqg4-j6r4-53mv,
critical, quote() command injection; resolves 1.12.0). Raises the #95 floor.
- @expo/cli > compression ^1.8.2 (GHSA-vc2v-76pw-4v95, high, dev server DoS).
- source-map-js@^1.0.0 -> ^1.2.2 (GHSA-68fv-2mgg-jv7q, high, postcss pipeline).
Lock: only the three package entries change, package key set identical.
Smoke test: floor guard plus a call to the consumed API for each package.
Export bundle byte-identical before/after (44 files). npm audit 43 -> 40,
critical 0. Build and dev tooling only, nothing ships in the APK.
Fixes#133Fixes#134Fixes#135
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>