0e4c5cdb4e
- @expo/cli > undici ^6.27.0 -> ^6.28.0: GHSA-8xcm-r25x-g524 / m8rv-5g2x-5cg5 / v3r7-h72x-cjcm (response desync, CRLF & cookie injection; vulnerable <6.28.0) - js-yaml -> ^3.15.1 (3.x) + ^4.3.1 (4.x): CVE-2026-59870 / GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap resolution; vulnerable 3.x<3.15.1, 4.x<4.3.1) js-yaml moved from parent-scoped overrides (@expo/xcpretty, @istanbuljs/load-nyc-config) to version-scoped ones (js-yaml@^3 / js-yaml@^4): the 4.x instance is reached via @expo/cli, which is itself overridden, and a nested override does not propagate through an overridden parent (npm left js-yaml@4.3.0 "invalid"). Version-scoped targeting resolves it regardless of the parent path. Both build/dev-time only, not bundled in the shipped APK. npm audit drops undici + js-yaml (16 -> 14). Remaining 13 high = image-size + its metro/RN cascade (upstream-locked, tracked in #108) + @babel/core low. Smoke test green, widget patch reapplied, lock diff limited to the 3 bumped packages. Fixes #106 Fixes #107 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
96 lines
2.8 KiB
JSON
96 lines
2.8 KiB
JSON
{
|
|
"name": "simpl-liste",
|
|
"main": "index.js",
|
|
"version": "1.6.5",
|
|
"scripts": {
|
|
"start": "expo start",
|
|
"test": "node tests/smoke.test.cjs && node --test --disable-warning=ExperimentalWarning --disable-warning=MODULE_TYPELESS_PACKAGE_JSON tests/feedback.test.mjs",
|
|
"android": "expo start --android",
|
|
"ios": "expo start --ios",
|
|
"web": "expo start --web",
|
|
"postinstall": "patch-package"
|
|
},
|
|
"dependencies": {
|
|
"@expo-google-fonts/inter": "^0.4.2",
|
|
"@expo/ngrok": "^4.1.3",
|
|
"@expo/vector-icons": "^15.0.3",
|
|
"@logto/rn": "^1.1.0",
|
|
"@react-native-async-storage/async-storage": "2.2.0",
|
|
"@react-native-community/datetimepicker": "8.4.4",
|
|
"@react-navigation/native": "^7.1.8",
|
|
"date-fns": "^4.1.0",
|
|
"drizzle-orm": "^0.45.2",
|
|
"expo": "~54.0.34",
|
|
"expo-auth-session": "~7.0.11",
|
|
"expo-calendar": "~15.0.8",
|
|
"expo-constants": "~18.0.13",
|
|
"expo-crypto": "~15.0.9",
|
|
"expo-file-system": "~19.0.21",
|
|
"expo-font": "~14.0.11",
|
|
"expo-haptics": "~15.0.8",
|
|
"expo-intent-launcher": "~13.0.8",
|
|
"expo-linking": "~8.0.12",
|
|
"expo-localization": "~17.0.8",
|
|
"expo-notifications": "~0.32.17",
|
|
"expo-router": "~6.0.23",
|
|
"expo-secure-store": "~15.0.8",
|
|
"expo-sharing": "~14.0.8",
|
|
"expo-splash-screen": "~31.0.13",
|
|
"expo-sqlite": "~16.0.10",
|
|
"expo-status-bar": "~3.0.9",
|
|
"expo-web-browser": "~15.0.11",
|
|
"i18next": "^25.8.13",
|
|
"lucide-react-native": "^0.575.0",
|
|
"nativewind": "^4.2.2",
|
|
"react": "19.1.0",
|
|
"react-dom": "19.1.0",
|
|
"react-i18next": "^16.5.4",
|
|
"react-native": "0.81.5",
|
|
"react-native-android-widget": "^0.21.0",
|
|
"react-native-draggable-flatlist": "^4.0.3",
|
|
"react-native-gesture-handler": "~2.28.0",
|
|
"react-native-keyboard-controller": "1.18.5",
|
|
"react-native-reanimated": "~4.1.1",
|
|
"react-native-safe-area-context": "~5.6.0",
|
|
"react-native-screens": "~4.16.0",
|
|
"react-native-svg": "15.12.1",
|
|
"react-native-web": "~0.21.0",
|
|
"react-native-worklets": "0.5.1",
|
|
"zustand": "^5.0.11"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "~19.1.0",
|
|
"drizzle-kit": "^0.31.9",
|
|
"patch-package": "^8.0.1",
|
|
"react-test-renderer": "19.1.0",
|
|
"tailwindcss": "^3.4.17",
|
|
"typescript": "~5.9.2"
|
|
},
|
|
"overrides": {
|
|
"esbuild": "^0.25.0",
|
|
"@xmldom/xmldom": "^0.8.13",
|
|
"uuid": "^11.1.1",
|
|
"postcss": "^8.5.18",
|
|
"js-yaml@^3.0.0": "^3.15.1",
|
|
"js-yaml@^4.0.0": "^4.3.1",
|
|
"@expo/cli": {
|
|
"ws": "^8.20.1",
|
|
"undici": "^6.28.0",
|
|
"tar": "^7.5.21"
|
|
},
|
|
"react-devtools-core": {
|
|
"shell-quote": "^1.8.4",
|
|
"ws": "^7.5.11"
|
|
},
|
|
"react-native": {
|
|
"ws": "^7.5.11"
|
|
},
|
|
"@react-native/dev-middleware": {
|
|
"ws": "^7.5.11"
|
|
},
|
|
"metro": {
|
|
"ws": "^7.5.11"
|
|
}
|
|
},
|
|
"private": true
|
|
}
|