pour application android simpl-liste
0e4c5cdb4e
- @expo/cli > undici ^6.27.0 -> ^6.28.0: GHSA-8xcm-r25x-g524 / m8rv-5g2x-5cg5 / v3r7-h72x-cjcm (response desync, CRLF & cookie injection; vulnerable <6.28.0) - js-yaml -> ^3.15.1 (3.x) + ^4.3.1 (4.x): CVE-2026-59870 / GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap resolution; vulnerable 3.x<3.15.1, 4.x<4.3.1) js-yaml moved from parent-scoped overrides (@expo/xcpretty, @istanbuljs/load-nyc-config) to version-scoped ones (js-yaml@^3 / js-yaml@^4): the 4.x instance is reached via @expo/cli, which is itself overridden, and a nested override does not propagate through an overridden parent (npm left js-yaml@4.3.0 "invalid"). Version-scoped targeting resolves it regardless of the parent path. Both build/dev-time only, not bundled in the shipped APK. npm audit drops undici + js-yaml (16 -> 14). Remaining 13 high = image-size + its metro/RN cascade (upstream-locked, tracked in #108) + @babel/core low. Smoke test green, widget patch reapplied, lock diff limited to the 3 bumped packages. Fixes #106 Fixes #107 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .claude | ||
| .vscode | ||
| app | ||
| assets | ||
| patches | ||
| src | ||
| tests | ||
| web | ||
| .gitignore | ||
| app.json | ||
| babel.config.js | ||
| CLAUDE.md | ||
| drizzle.config.ts | ||
| eas.json | ||
| index.js | ||
| masterplan.md | ||
| metro.config.js | ||
| nativewind-env.d.ts | ||
| package-lock.json | ||
| package.json | ||
| SECURITY.md | ||
| spec-simpl-liste-web.md | ||
| sql-transformer.js | ||
| STATE.md | ||
| tailwind.config.js | ||
| tsconfig.json | ||