chore(deps): close 10 HIGH Dependabot alerts (brace-expansion, js-yaml, tar, postcss, shell-quote)

[romainsalles]

Why

Vanta SOC 2 test packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high is failing. This repo carries 10 of the open HIGH findings, all transitive, all dev/test tooling (nothing in the published SDK).

What

Root yarn.lock (resolutions):

Alert	Package	Change
#726	brace-expansion	~1.1.13 → ~1.1.16 (CVE-2026-13149)
#739	js-yaml	>=4.2.0 → >=5.2.2 (GHSA-pm4m-ph32-ghv5)
#730	tar	>=7.5.16 → >=7.5.18 (GHSA-8x88-c5mf-7j5w)

brace-expansion stays on the 1.x line here: minimatch ~3.1.3 is pinned in this workspace and minimatch 3 can't consume brace-expansion 5.x (v5 replaced the CJS default export with a named expand).

test-projects/expo-purchasely-test (overrides):

Alert	Package	Change
#714, #736	brace-expansion	~1.1.13 → >=5.0.8
#715	js-yaml	→ ^4.3.0
#718	tar	>=7.5.10 → >=7.5.18
#734	postcss	>=8.5.10 → >=8.5.18

Here the only brace-expansion consumer is minimatch@10.2.5, which declares brace-expansion ^5.0.5 — so the previous ~1.1.13 pin was both vulnerable and feeding minimatch 10 a version whose export shape it doesn't expect. Moving to >=5.0.8 fixes both alerts at once. This supersedes Dependabot PR #269 (postcss).

test-projects/rn-purchasely-test (overrides):

Alert	Package	Change
#723	js-yaml	→ ^4.3.0
#724	shell-quote	→ >=1.9.0
—	brace-expansion	^5.0.5 → ^5.0.8 (pre-empts CVE-2026-14257)

Verification

Local, node 22 (yarn 3.6.1):

• yarn install → ok
• yarn lint → clean
• yarn typecheck → clean
• yarn test → 249 passing, 6 suites

Heads-up on CI

build-ios is failing on this repo independently of dependencies — the example app fails to link with missing facebook::react::Props / DebugStringConvertible vtables out of libRNScreens.a (ld: symbol(s) not found for architecture arm64). Same failure on Dependabot PR #269, and it does not touch any JS lockfile path. It will need a separate fix before this can merge on a green board.

Alert #740 (root brace-expansion <= 5.0.7, CVE-2026-14257) is not fixable here: the only patched version is 5.0.8, and the root workspace pins minimatch ~3.1.3. It needs a dismissal (tolerable risk — dev tooling, patterns come from our own configs) or dropping the minimatch pin org-wide.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

Updates root and test-project dependency overrides and lockfiles to resolve high-severity Dependabot alerts.

• Raises patched versions of brace-expansion, js-yaml, tar, postcss, and shell-quote.
• Regenerates the Yarn and npm lockfiles with the overridden dependency versions.

Confidence Score: 5/5

The dependency updates appear safe to merge, with no concrete compatibility or behavioral failures identified.

The overridden versions resolve consistently in their respective lockfiles, and the relevant consumers retain compatible APIs, export shapes, and Node engine requirements.

Important Files Changed

Filename	Overview
package.json	Updates root resolutions for brace-expansion, js-yaml, and tar without an identified compatibility failure.
yarn.lock	Resolves the updated root dependency constraints to the intended patched versions.
test-projects/expo-purchasely-test/package.json	Updates Expo test-project overrides for patched brace-expansion, js-yaml, postcss, and tar versions.
test-projects/expo-purchasely-test/package-lock.json	Regenerates the Expo test-project dependency graph consistently with the changed overrides.
test-projects/rn-purchasely-test/package.json	Updates React Native test-project overrides for brace-expansion, js-yaml, and shell-quote.
test-projects/rn-purchasely-test/package-lock.json	Regenerates the React Native test-project dependency graph with compatible patched transitive versions.

_{Reviews (1): Last reviewed commit: "chore(deps): close brace-expansion / js-..." | Re-trigger Greptile}