290c4e5e2f
metro@0.83.8 (published 2026-08-19) removed the image-size dependency and vendored a reduced dimension parser (src/lib/imageSize.js) that supports only bmp/gif/jpeg/ktx/png/psd/svg/tiff/webp. The ICNS, JXL and HEIF parsers named by GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq are absent from it, so the DoS is eliminated by construction rather than by an upstream patch: image-size still publishes no fixed version (latest is 2.0.2, and both advisories report first_patched_version = None). metro@0.83.3 was the only requester of image-size in the whole tree, so every transitive HIGH finding collapses with it. @expo/metro@54.2.0 pins the 14 metro packages to exact 0.83.3, so npm update cannot move them and an override is required. All 14 are moved together to avoid a mixed metro tree; the existing nested ws override is preserved through the "." key. npm audit: 19 -> 11 total, 9 HIGH -> 1 HIGH. The remaining HIGH (browserslist) is unrelated and pre-existing on master. Verified: image-size absent from both the lock file and node_modules, 14 metro packages resolved to 0.83.8 with no duplicates, patch-package postinstall still applies, npm test 11/11, and expo export --platform android produces a Hermes bundle with PNG dimension variations resolved through the vendored parser. Refs #108 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Y4GzEsmDryrwtQcmBNw9P
114 lines
3.4 KiB
JSON
114 lines
3.4 KiB
JSON
{
|
|
"name": "simpl-liste",
|
|
"main": "index.js",
|
|
"version": "1.6.6",
|
|
"scripts": {
|
|
"start": "expo start",
|
|
"test": "node tests/smoke.test.cjs && node --test --disable-warning=ExperimentalWarning --disable-warning=MODULE_TYPELESS_PACKAGE_JSON tests/feedback.test.mjs",
|
|
"android": "expo start --android",
|
|
"ios": "expo start --ios",
|
|
"web": "expo start --web",
|
|
"postinstall": "patch-package"
|
|
},
|
|
"dependencies": {
|
|
"@expo-google-fonts/inter": "^0.4.2",
|
|
"@expo/ngrok": "^4.1.3",
|
|
"@expo/vector-icons": "^15.0.3",
|
|
"@logto/rn": "^1.1.0",
|
|
"@react-native-async-storage/async-storage": "2.2.0",
|
|
"@react-native-community/datetimepicker": "8.4.4",
|
|
"@react-navigation/native": "^7.1.8",
|
|
"date-fns": "^4.1.0",
|
|
"drizzle-orm": "^0.45.2",
|
|
"expo": "~54.0.34",
|
|
"expo-auth-session": "~7.0.11",
|
|
"expo-calendar": "~15.0.8",
|
|
"expo-constants": "~18.0.13",
|
|
"expo-crypto": "~15.0.9",
|
|
"expo-file-system": "~19.0.21",
|
|
"expo-font": "~14.0.11",
|
|
"expo-haptics": "~15.0.8",
|
|
"expo-intent-launcher": "~13.0.8",
|
|
"expo-linking": "~8.0.12",
|
|
"expo-localization": "~17.0.8",
|
|
"expo-notifications": "~0.32.17",
|
|
"expo-router": "~6.0.23",
|
|
"expo-secure-store": "~15.0.8",
|
|
"expo-sharing": "~14.0.8",
|
|
"expo-splash-screen": "~31.0.13",
|
|
"expo-sqlite": "~16.0.10",
|
|
"expo-status-bar": "~3.0.9",
|
|
"expo-web-browser": "~15.0.11",
|
|
"i18next": "^25.8.13",
|
|
"lucide-react-native": "^0.575.0",
|
|
"nativewind": "^4.2.2",
|
|
"react": "19.1.0",
|
|
"react-dom": "19.1.0",
|
|
"react-i18next": "^16.5.4",
|
|
"react-native": "0.81.5",
|
|
"react-native-android-widget": "^0.21.0",
|
|
"react-native-draggable-flatlist": "^4.0.3",
|
|
"react-native-gesture-handler": "~2.28.0",
|
|
"react-native-keyboard-controller": "1.18.5",
|
|
"react-native-reanimated": "~4.1.1",
|
|
"react-native-safe-area-context": "~5.6.0",
|
|
"react-native-screens": "~4.16.0",
|
|
"react-native-svg": "15.12.1",
|
|
"react-native-web": "~0.21.0",
|
|
"react-native-worklets": "0.5.1",
|
|
"zustand": "^5.0.11"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "~19.1.0",
|
|
"drizzle-kit": "^0.31.9",
|
|
"patch-package": "^8.0.1",
|
|
"react-test-renderer": "19.1.0",
|
|
"tailwindcss": "^3.4.17",
|
|
"typescript": "~5.9.2"
|
|
},
|
|
"overrides": {
|
|
"esbuild": "^0.25.0",
|
|
"@xmldom/xmldom": "^0.8.13",
|
|
"uuid": "^11.1.1",
|
|
"postcss": "^8.5.18",
|
|
"js-yaml@^3.0.0": "^3.15.1",
|
|
"js-yaml@^4.0.0": "^4.3.1",
|
|
"brace-expansion@^1.0.0": "^1.1.18",
|
|
"brace-expansion@^2.0.0": "^2.1.4",
|
|
"brace-expansion@^5.0.0": "^5.0.9",
|
|
"@babel/core": "^7.29.6",
|
|
"@expo/cli": {
|
|
"ws": "^8.20.1",
|
|
"undici": "^6.28.0",
|
|
"tar": "^7.5.21"
|
|
},
|
|
"react-devtools-core": {
|
|
"shell-quote": "^1.8.4",
|
|
"ws": "^7.5.11"
|
|
},
|
|
"react-native": {
|
|
"ws": "^7.5.11"
|
|
},
|
|
"@react-native/dev-middleware": {
|
|
"ws": "^7.5.11"
|
|
},
|
|
"metro": {
|
|
"ws": "^7.5.11",
|
|
".": "^0.83.8"
|
|
},
|
|
"metro-babel-transformer": "^0.83.8",
|
|
"metro-cache": "^0.83.8",
|
|
"metro-cache-key": "^0.83.8",
|
|
"metro-config": "^0.83.8",
|
|
"metro-core": "^0.83.8",
|
|
"metro-file-map": "^0.83.8",
|
|
"metro-minify-terser": "^0.83.8",
|
|
"metro-resolver": "^0.83.8",
|
|
"metro-runtime": "^0.83.8",
|
|
"metro-source-map": "^0.83.8",
|
|
"metro-symbolicate": "^0.83.8",
|
|
"metro-transform-plugins": "^0.83.8",
|
|
"metro-transform-worker": "^0.83.8"
|
|
},
|
|
"private": true
|
|
}
|