fix: bump devDependency resolutions to clear 14 CVEs - #331
Merged
Conversation
All affected packages are build/test-toolchain devDependencies. The published SDK ships only react-redux and redux, so consumers were never exposed; this clears the Vanta/Dependabot alerts. - tar ^7.5.11 -> ^7.5.19 (CVE-2026-59873 CRITICAL, CVE-2026-59874) - fast-uri ^3.1.2 -> ^3.1.5 (CVE-2026-13676, 16221, 18446) - shell-quote ^1.8.4 -> ^1.9.0 (CVE-2026-13311) - brace-expansion ^2.1.3 (CVE-2026-13149, CVE-2026-14257) - ip-address ^10.3.1 (CVE-2026-69192) - js-yaml ^3.15.1 / ^4.3.1 (CVE-2026-59869, GHSA-5p4m-2wfm-xmqj) - ws ^6.2.4 / ^7.5.11 (CVE-2026-48779) js-yaml and ws are pinned per-descriptor because two majors coexist in the tree; an unqualified resolution would force one major onto both consumers. Not addressed here: linkify-it (CVE-2026-59887) stays at 2.2.0. It is pinned by markdown-it@^10, which requires linkify-it@^2, so forcing 5.x would break it. markdown-it runs only inside release-it's changelog generator over our own commit messages, so there is no attacker- controlled input path. Tracked as dismissed in Vanta. Resolutions are used rather than upgrading the direct dependencies because react-native and @react-native-community/cli are pinned to exact versions (0.81.1 / 20.1.2) and pull in most of these transitively. Verified: yarn test, typecheck, lint, and bob build all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
lankybutmacho
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears 14 Vanta / Dependabot alerts (1 CRITICAL, 13 HIGH) in the build and test toolchain.
Why this is low risk
Every affected package is a devDependency of the React Native / Metro / Jest / release-it toolchain. The published SDK ships only
react-reduxandreduxas runtimedependencies, so npm consumers were never exposed — this is about clearing our own alert surface, not a consumer-facing vulnerability.All bumps are patch or minor. No API surface changes.
Changes
tarfast-urishell-quotebrace-expansionip-addressjs-yamlwsjs-yamlandwsare pinned per-descriptor ("js-yaml@^3.13.1","ws@^7", etc.) because two majors coexist in the tree — an unqualified resolution would force one major onto both consumers and break the other.Why resolutions rather than upgrading the direct dependencies
Per CLAUDE.md, upgrading the direct dependency is preferred. Here it isn't practical:
react-native(0.81.1) and@react-native-community/cli(20.1.2) are pinned to exact versions and pull in most of these transitively. Bumping React Native to fix a DoS in the Metro dev server'swsis a far larger change than the risk warrants. Resolutions are the established stopgap in this repo.Not addressed here
linkify-it(CVE-2026-59887) stays at 2.2.0. It is pinned bymarkdown-it@^10, which requireslinkify-it@^2, so forcing 5.0.2 would break it.markdown-itis reached only throughrelease-it's conventional-changelog generator, parsing our own commit messages during a maintainer-initiated publish — no attacker-controlled input path. Dismissed in Vanta and Dependabot (alert 308) as tolerable risk; revisit on amarkdown-itmajor upgrade.Verification
yarn test— 2 suites passed, 1 todoyarn typecheck— cleanyarn lint— cleanyarn prepare(bob build) — commonjs, module, and typescript targets all wrote successfullyResolved versions confirmed at or above each advisory's patched version in
yarn.lock.🤖 Generated with Claude Code