pour application android simpl-liste
98cd423a50
- brace-expansion -> ^1.1.18 / ^2.1.4 / ^5.0.9 (version-scoped per major): DoS advisories (exponential-time expansion + unbounded OOM). Version-scoping bumps each major within its own major, preserving the CJS export contract (default export for 1.x/2.x, named for 5.x) that a blanket override would have broken. This is #103's original blocker, now resolved. Verified: minimatch@3 glob resolution works (the exact call that TypeError'd under a blanket). - @babel/core -> ^7.29.6 (resolves 7.29.7): GHSA-4x5r-pxfx-6jf8 arbitrary file read via sourceMappingURL (vulnerable <=7.29.0, ~87 deduped instances). Both build/dev-time only, not bundled in the shipped APK. npm audit 14 -> 12; the remaining 12 high are entirely the image-size upstream-locked cascade (no published fix, tracked in #108). Smoke test 11/11, lock diff is 1:1 version replacements (large count driven by @babel/core's deduped instances). Fixes #103 Fixes #110 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .claude | ||
| .vscode | ||
| app | ||
| assets | ||
| patches | ||
| src | ||
| tests | ||
| web | ||
| .gitignore | ||
| app.json | ||
| babel.config.js | ||
| CLAUDE.md | ||
| drizzle.config.ts | ||
| eas.json | ||
| index.js | ||
| masterplan.md | ||
| metro.config.js | ||
| nativewind-env.d.ts | ||
| package-lock.json | ||
| package.json | ||
| SECURITY.md | ||
| spec-simpl-liste-web.md | ||
| sql-transformer.js | ||
| STATE.md | ||
| tailwind.config.js | ||
| tsconfig.json | ||