From a0c514c76419b33caa2fa9ac750033319416c842 Mon Sep 17 00:00:00 2001 From: Mike Singleton Date: Tue, 11 Aug 2026 16:43:44 -0400 Subject: [PATCH] fix: bump devDependency resolutions to clear 14 CVEs All affected packages are build/test-toolchain devDependencies. The published SDK ships only react-redux and redux, so consumers were never exposed; this clears the Vanta/Dependabot alerts. - tar ^7.5.11 -> ^7.5.19 (CVE-2026-59873 CRITICAL, CVE-2026-59874) - fast-uri ^3.1.2 -> ^3.1.5 (CVE-2026-13676, 16221, 18446) - shell-quote ^1.8.4 -> ^1.9.0 (CVE-2026-13311) - brace-expansion ^2.1.3 (CVE-2026-13149, CVE-2026-14257) - ip-address ^10.3.1 (CVE-2026-69192) - js-yaml ^3.15.1 / ^4.3.1 (CVE-2026-59869, GHSA-5p4m-2wfm-xmqj) - ws ^6.2.4 / ^7.5.11 (CVE-2026-48779) js-yaml and ws are pinned per-descriptor because two majors coexist in the tree; an unqualified resolution would force one major onto both consumers. Not addressed here: linkify-it (CVE-2026-59887) stays at 2.2.0. It is pinned by markdown-it@^10, which requires linkify-it@^2, so forcing 5.x would break it. markdown-it runs only inside release-it's changelog generator over our own commit messages, so there is no attacker- controlled input path. Tracked as dismissed in Vanta. Resolutions are used rather than upgrading the direct dependencies because react-native and @react-native-community/cli are pinned to exact versions (0.81.1 / 20.1.2) and pull in most of these transitively. Verified: yarn test, typecheck, lint, and bob build all pass. Co-Authored-By: Claude Opus 5 --- package.json | 13 +++++++--- yarn.lock | 72 ++++++++++++++++++++++++++-------------------------- 2 files changed, 46 insertions(+), 39 deletions(-) diff --git a/package.json b/package.json index 4f5bc2f..67258a0 100644 --- a/package.json +++ b/package.json @@ -85,14 +85,21 @@ "@types/react": "^18.0.0 || ^19.0.0", "glob": "^10.5.0", "qs": "^6.14.0", - "tar": "^7.5.11", + "tar": "^7.5.19", "minimatch": "^9.0.7", "fast-xml-parser": "^5.5.6", "fast-xml-builder": "^1.1.7", - "fast-uri": "^3.1.2", + "fast-uri": "^3.1.5", "@babel/plugin-transform-modules-systemjs": "^7.29.4", "undici": "^6.24.0", - "shell-quote": "^1.8.4" + "shell-quote": "^1.9.0", + "brace-expansion": "^2.1.3", + "ip-address": "^10.3.1", + "js-yaml@^3.13.1": "^3.15.1", + "js-yaml@^4.1.0": "^4.3.1", + "ws@^6.2.3": "^6.2.4", + "ws@^7": "^7.5.11", + "ws@^7.5.10": "^7.5.11" }, "peerDependencies": { "react": ">=18.0.0", diff --git a/yarn.lock b/yarn.lock index 699e65b..f1dfa4f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4234,12 +4234,12 @@ __metadata: languageName: node linkType: hard -"brace-expansion@npm:^2.0.2": - version: 2.0.2 - resolution: "brace-expansion@npm:2.0.2" +"brace-expansion@npm:^2.1.3": + version: 2.1.4 + resolution: "brace-expansion@npm:2.1.4" dependencies: balanced-match: ^1.0.0 - checksum: 01dff195e3646bc4b0d27b63d9bab84d2ebc06121ff5013ad6e5356daa5a9d6b60fa26cf73c74797f2dc3fbec112af13578d51f75228c1112b26c790a87b0488 + checksum: a2e0b87c1d348fe7a424f8e383e113ac9c4f111753dba60069aa22d55de6855695bf83f56d9a96c92fb14f42be17e272d5a2761eac7e25ca6687fa2b6efa44a8 languageName: node linkType: hard @@ -6138,10 +6138,10 @@ __metadata: languageName: node linkType: hard -"fast-uri@npm:^3.1.2": - version: 3.1.2 - resolution: "fast-uri@npm:3.1.2" - checksum: 73a6e1b04e6fcf7a09ed93316e72d643ef177d26969973784690708612141f2c2f74657120bab75bf5bbc26bfd535a32c90a8c3bc50aca50584cf01f98815afe +"fast-uri@npm:^3.1.5": + version: 3.1.5 + resolution: "fast-uri@npm:3.1.5" + checksum: 8a95af13e0730ac5c3abeb7f3939dee9fa95f2652e0ebac7a072b5597f836200084340c9bc2030f392318cdb49ec04e3fd6f558fa24c58d6d373557b9c01d7fb languageName: node linkType: hard @@ -7066,10 +7066,10 @@ __metadata: languageName: node linkType: hard -"ip-address@npm:^10.0.1": - version: 10.1.0 - resolution: "ip-address@npm:10.1.0" - checksum: 76b1abcdf52a32e2e05ca1f202f3a8ab8547e5651a9233781b330271bd7f1a741067748d71c4cbb9d9906d9f1fa69e7ddc8b4a11130db4534fdab0e908c84e0d +"ip-address@npm:^10.3.1": + version: 10.5.0 + resolution: "ip-address@npm:10.5.0" + checksum: ffb64aea3ab0bf975b237954f89bf3c37cb5fc9d078cf5868408e54d29636d14618ed67dafcde664b3cdfc778ee78c811286cf67e59d1243a0c198d05aa47683 languageName: node linkType: hard @@ -8139,26 +8139,26 @@ __metadata: languageName: node linkType: hard -"js-yaml@npm:^3.13.1": - version: 3.14.2 - resolution: "js-yaml@npm:3.14.2" +"js-yaml@npm:^3.15.1": + version: 3.15.1 + resolution: "js-yaml@npm:3.15.1" dependencies: argparse: ^1.0.7 esprima: ^4.0.0 bin: js-yaml: bin/js-yaml.js - checksum: 626fc207734a3452d6ba84e1c8c226240e6d431426ed94d0ab043c50926d97c509629c08b1d636f5d27815833b7cfd225865631da9fb33cb957374490bf3e90b + checksum: 536cfb984b61d1544dbdbe394254dd13481a94171cb3a61608572d9112a63cbace9dd900cb83a4e530ac36427fff77d9e1cb6734917c6fea951d00b4f7bbb163 languageName: node linkType: hard -"js-yaml@npm:^4.1.0": - version: 4.1.1 - resolution: "js-yaml@npm:4.1.1" +"js-yaml@npm:^4.3.1": + version: 4.3.1 + resolution: "js-yaml@npm:4.3.1" dependencies: argparse: ^2.0.1 bin: js-yaml: bin/js-yaml.js - checksum: ea2339c6930fe048ec31b007b3c90be2714ab3e7defcc2c27ebf30c74fd940358f29070b4345af0019ef151875bf3bc3f8644bea1bab0372652b5044813ac02d + checksum: 482740e69a1769b355d7182234c0fa197237f02e6a5c8c0b70a763af6a712c9741de350d784a5659e00cf03cedd6ebfa506d59ca45967e3ee50dd4f4df18f2e7 languageName: node linkType: hard @@ -11053,10 +11053,10 @@ __metadata: languageName: node linkType: hard -"shell-quote@npm:^1.8.4": - version: 1.8.4 - resolution: "shell-quote@npm:1.8.4" - checksum: 082dc836baa8ade01144ee3068af487ea45ba570ea6ab13a5eddc11ab16a976b8857b51ef2caf7dc9a1e173ff0aea685b8f78b4f6f5a0a1ef24c7b17c51350e2 +"shell-quote@npm:^1.9.0": + version: 1.10.0 + resolution: "shell-quote@npm:1.10.0" + checksum: d4bc0757ae0e493d0f6e3327c93be7d5af1d39e9969eb4332ed4e40bb2c3f9112ec31e979d713d302605f7e3431d9f5f061719e0e177077ffd9c03c0b9cc5f73 languageName: node linkType: hard @@ -11557,16 +11557,16 @@ __metadata: languageName: node linkType: hard -"tar@npm:^7.5.11": - version: 7.5.11 - resolution: "tar@npm:7.5.11" +"tar@npm:^7.5.19": + version: 7.5.22 + resolution: "tar@npm:7.5.22" dependencies: "@isaacs/fs-minipass": ^4.0.0 chownr: ^3.0.0 minipass: ^7.1.2 minizlib: ^3.1.0 yallist: ^5.0.0 - checksum: 7f6785a85dd571b88985e493ec86f692962cbfa7b4017961fddfd2241e0ff3bcd89ed347f4c02b5433aa22b30cca5566e8711543df054fda8fd12425f505378f + checksum: e1434f40954410d191ab6d89017bfd40c24869cfd319d19dd74f84db13cbea15370a22bc9b8ecd699d05c2777ec6297f35dac318ed4829b6e776a7cb4f1f7c68 languageName: node linkType: hard @@ -12276,18 +12276,18 @@ __metadata: languageName: node linkType: hard -"ws@npm:^6.2.3": - version: 6.2.3 - resolution: "ws@npm:6.2.3" +"ws@npm:^6.2.4": + version: 6.2.6 + resolution: "ws@npm:6.2.6" dependencies: async-limiter: ~1.0.0 - checksum: bbc96ff5628832d80669a88fd117487bf070492dfaa50df77fa442a2b119792e772f4365521e0a8e025c0d51173c54fa91adab165c11b8e0674685fdd36844a5 + checksum: a112f68d8a876ac50a72dc180518f10955a94497f6dcb475d66d92400d36079bbabe24f204e820c3765470831c967f4ab7a38f138cb17e17172697677403848b languageName: node linkType: hard -"ws@npm:^7, ws@npm:^7.5.10": - version: 7.5.10 - resolution: "ws@npm:7.5.10" +"ws@npm:^7.5.11": + version: 7.5.13 + resolution: "ws@npm:7.5.13" peerDependencies: bufferutil: ^4.0.1 utf-8-validate: ^5.0.2 @@ -12296,7 +12296,7 @@ __metadata: optional: true utf-8-validate: optional: true - checksum: f9bb062abf54cc8f02d94ca86dcd349c3945d63851f5d07a3a61c2fcb755b15a88e943a63cf580cbdb5b74436d67ef6b67f745b8f7c0814e411379138e1863cb + checksum: 2c3e3526d99fcc9792992d5e62b152583869b5f0e9d62f5cf12b8cda36bf0b66b33feabf320c16e22d901415f8770138635129cec56afc3d4212f791f7f630a2 languageName: node linkType: hard