[aarsilv]

🤖 Generated from Claude

Jira: FFESUPPORT-997

This PR closes the Dependabot and yarn audit findings that have a fix inside the current major versions. It changes both lockfiles. The published code does not change: the runtime dependency closure is identical, and the built lib/ JavaScript and type files are identical. The SDK reports version 4.0.1, because it reads package.json at run time. Only the version (4.0.1) and the devDependency ranges in the packed package.json (and its copy in lib/) change.

Advisories

Package	Advisories	Lockfile	Before → after	Ships?
brace-expansion	GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895	both	1.1.14 / 2.1.1 / 5.0.6 → 1.1.21 / 2.1.7 / 5.0.12	No
js-yaml	GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh	both	3.15.0 / 4.3.0 → 3.15.2 / 4.3.2	No
browserslist	GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx	both	4.28.2 → 4.29.1	No
baseline-browser-mapping	GHSA-w5vr-8v7q-w6rv	both	2.10.32 → 2.11.26	No
shell-quote	GHSA-395f-4hp3-45gv	both	1.8.4 → 1.10.0	No
image-size	GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr	root	1.2.1 → removed (metro 0.84.4 → 0.84.6)	No
@xmldom/xmldom	14 advisories (GHSA-27p8-2357-5qqv, GHSA-4w3w-2rp5-g8jm, and others)	example	0.8.13 / 0.9.10 → 0.8.15 / 0.9.12	No
nanoid	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8	example	3.3.12 → 3.3.19	No
postcss	GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp	example	8.5.15 → 8.5.28	No
tar	GHSA-r292-9mhp-454m	example	7.5.20 → 7.5.22	No
undici	GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm	example	6.27.0 → 6.29.0	No

"Ships?" asks if the code is in the published npm package. None of these packages is in the SDK runtime dependency closure. The example app is private and is not published.

What changed

Root (package.json, yarn.lock): SDK dev tooling

• Raise the devDependency floors to the latest in-major releases: @types/react, @typescript-eslint/*, eslint-plugin-prettier, jest, prettier, testdouble, @babel/core, typescript.
• Re-resolve the flagged transitive packages in their declared ranges. The metro packages (and ob1) move 0.84.4 → 0.84.6. metro 0.84.6 does not depend on image-size.
• The jest 30.5 update adds test-exclude 7.0.2 next to 6.0.0 (two majors, two requesters) and @parcel/watcher (a jest-haste-map dependency with optional per-platform native binaries).
• No resolutions. No change to dependencies.

Example app (example/package.json, example/yarn.lock)

• Set expo ~54.0.37, expo-constants ~18.0.14, expo-font ~14.0.12, and expo-router ~6.0.24. expo install --check asks for these versions on SDK 54. Raise the eslint floor to ^9.39.5.
• Raise the existing postcss resolution from ^8.5.10 to ^8.5.23, the first patched version. The resolution stays because @expo/metro-config asks for postcss ~8.4.32.
• Re-resolve the flagged transitive packages in range. The Expo major (SDK 54), react-native 0.81.5, and @react-navigation/native 7.2.5 do not change. @expo/cli 54.0.27 adds agent-cli-detector 0.1.7 (Expo package, no install script).

Version bump to 4.0.1 (its own commit). Version 4.0.0 is not on npm: its publish run failed at job setup when the release-kit/semver action download failed. npm latest is still 3.8.0. The v4.0.0 GitHub release and tag exist. A new version avoids moving or deleting that tag. The SDK reads sdkVersion from package.json, so the reported SDK version becomes 4.0.1.

How the tests and CI protect this change

• CI (ci.yml) runs lint, typecheck, make test, and yarn prepack for the root on Node 20. The cache key hashes both lockfiles, so this PR's first run installs from the new lockfile. All three CI jobs pass on this branch.
• Local, Node 20.20.2: yarn install --frozen-lockfile, yarn lint, yarn typecheck, make test (38 of 38 tests), and yarn prepack pass. The same steps pass in a node:20 Linux container (arm64).
• lib/ built before and after is identical, except the copied package.json.
• yarn audit: root reports 0 vulnerabilities. Example reports only the 3 deferred advisories. An OSV scan of both lockfiles gives the same result.
• Example (no CI job): yarn install --frozen-lockfile passes, with the same unmet @expo/metro-runtime peer warning that expo-router 6.0.23 also declares. expo install --check passes (it fails on main). expo export --platform all bundles iOS, Android, and web. Module counts match main within one (iOS 1094 vs 1095). tsc and expo lint each report the same single error as on main. The postcss resolution already overrode Expo's ~8.4.32 range on main.

Not validated before merge

• Native iOS and Android builds of the example app, and a run on a device or simulator. No CI job builds the example.
• publish.yaml. It runs only on a release. It runs yarn install, yarn test, and yarn prepack. CI runs the same jest suite (through make test) and the same yarn prepack.
• Dependabot alert closure. Dependabot rescans after merge.

Deferred

• example image-size (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr): two metro copies pull it. @expo/metro 54.2.0 pins metro 0.83.3 exactly. React Native 0.81.5 pulls metro 0.83.7. metro 0.83.8 drops image-size. The first Expo release that uses it is @expo/metro 55.1.2 (Expo SDK 55). An Expo major needs native builds that CI does not run. metro calls image-size to read the size of image assets that it bundles.
• example decode-uri-component (GHSA-vcc3-ghjq-m6fr): the latest expo-router of each SDK line (6.0.24, 55.0.18, 56.2.21, 57.0.23) needs query-string ^7.1.3, which needs decode-uri-component ^0.2.2. The fix (0.5.0) is ESM only with a default export. query-string 7.1.3 calls require('decode-uri-component') as a function, so a resolution to 0.5.0 would break it.
• Root majors, not needed to close an advisory:
  • eslint 10: the root config is in eslintrc format (eslintConfig in package.json). ESLint 9 and later use flat config.
  • typescript 6+: TS 6 rejects the baseUrl and moduleResolution: node options in tsconfig.json. TypeScript emits the shipped .d.ts files.
  • @babel/core 8: @react-native/babel-preset 0.85.3 depends on @babel/core ^7.25.2.
  • react-native and @react-native/* 0.87: React Native minor releases can break. The root pins 0.85.3 exactly.
  • react-native-builder-bob 0.43: it builds the shipped lib/.
  • @evilmartians/lefthook 2: CI does not run the git hooks.
• @react-native-async-storage/async-storage 3.x: runtime major, no advisory.
• @eppo/js-client-sdk-common bump: tracked in FFESUPPORT-691.

Dependabot PRs

All 12 open Dependabot PRs (#81 to #117) target versions that main already resolves or passes. This PR moves tar (#106), undici (#108), and @xmldom/xmldom (#116) further. This PR does not close them.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🔵 Needs a closer look

Multiple dependency and lockfile changes, plus unvalidated native example builds and publishing workflow, warrant human review.

Review effort: Lite
Findings: None

What changed in this PR

Remediates September 2026 vulnerabilities across root tooling and the example app without changing runtime SDK code.

Changes:

• Updates root development dependencies and lockfile resolutions.
• Updates Expo example dependencies and security resolutions.
• Removes the vulnerable root image-size dependency.
• Corrects the claim that published package metadata is unchanged.

File	Summary
package.json	Updates root development dependencies and publish metadata.
yarn.lock	Resolves patched root tooling and transitive dependencies.
example/​package.json	Updates Expo tooling and security resolutions.
example/​yarn.lock	Resolves updated example-app dependencies and vulnerabilities.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aarsilv]

🤖 Response from codex:

Codex (read-only) checked the PR description against the diff, both lockfiles, the CI workflows, and the executed evidence. It ran after the pre-push review and took three rounds.

Pre-push review: no blocking issues found. Per advisory: every root and example row is CLOSED, except the two deferred example rows (image-size 1.2.1 and decode-uri-component 0.2.2).

Fact-check, round 1: FIX FIRST. Corrections made in the description:

• It said the published package does not change. The packed package.json and its copy in lib/ carry the new devDependency ranges. The description now says only the JS and type output is identical.
• "No runtime dependency moves" had no before/after proof. A runtime closure comparison now shows the same 39 packages.
• It said module counts were the same. iOS is 1094 vs 1095. The description now gives the numbers.
• It said publish.yaml uses the same steps as CI. It does not (yarn install, yarn test). The description now names only the shared steps.
• Added the new packages (agent-cli-detector, a second test-exclude major) and both metro paths to image-size in the example. Added the existing peer warning.
• Removed four overclaims: "only Expo SDK 55", "only the app's own image assets", "expo-router 6.x through 57.x", and "no CI coverage" for lefthook.

Round 2: FIX FIRST. All 14 round-1 objections FIXED. New finding: @parcel/watcher is a normal jest-haste-map dependency; only its per-platform binaries are optional. Fixed.

Round 3: POST AS IS. No claim is contradicted by the source or the evidence.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Broad dependency and lockfile changes include unvalidated native example builds, requiring human review.

Review effort: Lite
Findings: None

[Copilot]

Copilot review overview

🔵 Needs a closer look

Native example-app builds and release publishing remain unvalidated.

Review effort: Lite
Findings: None