pour application android simpl-liste
5e7a566155
browserslist <= 4.28.6 carries two HIGH advisories published 2026-09-01: GHSA-c83g-rgw3-j3cx (unbounded memory growth, no cache eviction, leading to OOM) and GHSA-73wf-gq98-2v4g (uncaught crash / prototype write via an untrusted browserslist-stats.json in normalizeStats). Both report first_patched_version = 4.28.7. Unlike the image-size root fixed in #114, this one has a published fix, so a plain version floor is enough. Every requester already uses a caret range compatible with 4.28.7 (@babel/helper-compilation-targets ^4.24.0, @expo/metro-config ^4.25.0, core-js-compat ^4.28.1, update-browserslist-db peer >= 4.21.0) -- the lock was simply pinned at 4.28.1. The override records the security floor the same way as the existing esbuild, @xmldom/xmldom, postcss, brace-expansion and @babel/core entries. Resolves to 4.28.9. npm audit: 11 -> 10 total, 1 HIGH -> 0 HIGH. No high or critical finding remains in the tree. Verified: the lock stays unchanged under re-resolution against package.json, npm ci accepts the pair (what EAS runs), npm test 11/11, and expo export --platform android emits a byte-identical Hermes bundle (index-3d9ab1a7942c6dfccc79d9b280b8ce80.hbc, 8.17 MB) -- the compilation targets browserslist resolves are unchanged. Refs #115 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Y4GzEsmDryrwtQcmBNw9P |
||
|---|---|---|
| .claude | ||
| .vscode | ||
| app | ||
| assets | ||
| patches | ||
| src | ||
| tests | ||
| web | ||
| .gitignore | ||
| app.json | ||
| babel.config.js | ||
| CLAUDE.md | ||
| drizzle.config.ts | ||
| eas.json | ||
| index.js | ||
| masterplan.md | ||
| metro.config.js | ||
| nativewind-env.d.ts | ||
| package-lock.json | ||
| package.json | ||
| SECURITY.md | ||
| spec-simpl-liste-web.md | ||
| sql-transformer.js | ||
| STATE.md | ||
| tailwind.config.js | ||
| tsconfig.json | ||