pour application android simpl-liste
290c4e5e2f
metro@0.83.8 (published 2026-08-19) removed the image-size dependency and vendored a reduced dimension parser (src/lib/imageSize.js) that supports only bmp/gif/jpeg/ktx/png/psd/svg/tiff/webp. The ICNS, JXL and HEIF parsers named by GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq are absent from it, so the DoS is eliminated by construction rather than by an upstream patch: image-size still publishes no fixed version (latest is 2.0.2, and both advisories report first_patched_version = None). metro@0.83.3 was the only requester of image-size in the whole tree, so every transitive HIGH finding collapses with it. @expo/metro@54.2.0 pins the 14 metro packages to exact 0.83.3, so npm update cannot move them and an override is required. All 14 are moved together to avoid a mixed metro tree; the existing nested ws override is preserved through the "." key. npm audit: 19 -> 11 total, 9 HIGH -> 1 HIGH. The remaining HIGH (browserslist) is unrelated and pre-existing on master. Verified: image-size absent from both the lock file and node_modules, 14 metro packages resolved to 0.83.8 with no duplicates, patch-package postinstall still applies, npm test 11/11, and expo export --platform android produces a Hermes bundle with PNG dimension variations resolved through the vendored parser. Refs #108 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Y4GzEsmDryrwtQcmBNw9P |
||
|---|---|---|
| .claude | ||
| .vscode | ||
| app | ||
| assets | ||
| patches | ||
| src | ||
| tests | ||
| web | ||
| .gitignore | ||
| app.json | ||
| babel.config.js | ||
| CLAUDE.md | ||
| drizzle.config.ts | ||
| eas.json | ||
| index.js | ||
| masterplan.md | ||
| metro.config.js | ||
| nativewind-env.d.ts | ||
| package-lock.json | ||
| package.json | ||
| SECURITY.md | ||
| spec-simpl-liste-web.md | ||
| sql-transformer.js | ||
| STATE.md | ||
| tailwind.config.js | ||
| tsconfig.json | ||