fix(deps): remediate CRITICAL/high audit advisories (no breaking changes) - #54
Merged
Merged
Conversation
…changes Non-forced `npm audit fix` (legacy-peer-deps, matching CI resolution). Clears both CRITICAL advisories — shell-quote (quote() newline-escape) and tar (PAX size-override) — plus 8 high and 2 low transitive advisories, all via same-major bumps. No semver-major changes were applied: the expo 54->57 / metro cluster and the bogus-resolution react-navigation moderates are intentionally left for a dedicated migration PR. Audit: 41 -> 27 total (critical 2->0, high 18->10, low 2->0). Verified: `npx expo export --platform web` succeeds (the CI gate). Only package-lock.json changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Remediates the dependency vulnerabilities that are fixable without any breaking (semver-major) change, applied via a non-forced
npm audit fixusing the repo's own--legacy-peer-depsresolution mode (matching CI).Fixed — both CRITICALs + highs
shell-quote—quote()does not escape newlines in object.opvalues (command-injection class)tar— PAX size-override applied to intermediary GNU long-name/long-link headersAll fixes are same-major version bumps. Only
package-lock.jsonchanged.Audit delta
Intentionally deferred (not in this PR)
The residual 27 are the
expo54→57 /metromajor-upgrade cluster and a few advisories whose only npm-proposed "fix" resolves to a bogus ancient version (e.g.@react-navigation/*). These require a real framework migration, not a lockfile bump, and belong in a dedicated PR — especially given this repo's development pause (#51).Verification
npx expo export --platform web— passes (exit 0, bundles +dist/produced). This is the CI gate and exercises the exact bundler/build path where the fixed deps (shell-quote,tar, metro tooling) live.Test plan
npm ci --legacy-peer-depscleannpm audit fix(non-forced) applies only same-major fixesnpx expo export --platform websucceeds🤖 Generated with Claude Code