chore(security): patch audit findings

.github/workflows/branch-validation.yml

@@ -17,7 +17,7 @@ jobs:
   # Lint, format and typecheck come from the shared workflow in GSTJ/magic.
   # Node version is read from .nvmrc and pnpm from the `packageManager` field.
   checkup:
-    uses: GSTJ/magic/.github/workflows/ci.yml@aa331e83282c2794edd474646c671f036dfabee0 # v1
+    uses: GSTJ/magic/.github/workflows/ci.yml@4c640f094849d988c7380e1512f87c46a5408515 # v1.12.3
     with:
       # `pnpm install` already runs `prepare`, which is `bob build`. Running it
       # again is what fails the job if the build breaks.

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
   # runs that workflow, so this is where a push to master gets checked, and the
   # release below cannot start until it passes.
   checkup:
-    uses: GSTJ/magic/.github/workflows/ci.yml@aa331e83282c2794edd474646c671f036dfabee0 # v1
+    uses: GSTJ/magic/.github/workflows/ci.yml@4c640f094849d988c7380e1512f87c46a5408515 # v1.12.3
     with:
       build-command: pnpm run build
       test-command: pnpm test
@@ -50,7 +50,7 @@ jobs:
           fetch-depth: 0
 
       - name: 🏗 Setup Node + pnpm
-        uses: GSTJ/magic/.github/actions/setup@aa331e83282c2794edd474646c671f036dfabee0 # v1
+        uses: GSTJ/magic/.github/actions/setup@4c640f094849d988c7380e1512f87c46a5408515 # v1.12.3
 
       - name: 🧾 Plan the release
         id: plan
@@ -59,7 +59,7 @@ jobs:
   release:
     needs: [checkup, plan]
     if: needs.plan.outputs.release == 'true'
-    uses: GSTJ/magic/.github/workflows/release.yml@aa331e83282c2794edd474646c671f036dfabee0 # v1
+    uses: GSTJ/magic/.github/workflows/release.yml@4c640f094849d988c7380e1512f87c46a5408515 # v1.12.3
     permissions:
       contents: write
       id-token: write

.husky/commit-msg

@@ -1 +1 @@
-pnpm exec commitlint -E HUSKY_GIT_PARAMS
+pnpm exec commitlint --edit "$1"

example/app.json

@@ -1,6 +1,4 @@
 {
-  "name": "react-native-magic-toast-example",
-  "displayName": "MagicToast Example",
   "expo": {
     "name": "react-native-magic-toast-example",
     "slug": "react-native-magic-toast-example",

package.json

@@ -52,7 +52,7 @@
     "lint": "oxlint --report-unused-disable-directives",
     "lint:fix": "oxlint --report-unused-disable-directives --fix",
     "pods": "pnpm --filter react-native-magic-toast-example exec pod-install --quiet",
-    "prepare": "bob build",
+    "prepare": "bob build && husky",
     "release": "release-it",
     "test": "jest",
     "typecheck": "tsc --noEmit"

pnpm-workspace.yaml

@@ -12,23 +12,9 @@ dedupeDirectDeps: true
 overrides:
   "@types/react": "~19.2.14"
   "uuid": "^11.1.1"
-  # GHSA-mh99-v99m-4gvg / CVE-2026-14257. jest's glob@7 and test-exclude@6 pull
-  # minimatch@3, which pins brace-expansion@1, and 1.1.16 is the vulnerable one.
-  # The fix landed in 1.1.17 and caps how many characters a single `expand()`
-  # may accumulate; nothing under that cap behaves differently, and a glob
-  # pattern that would reach 4M characters of output is not one jest is passing.
-  # Scoped to the 1.x range because the tree also carries brace-expansion@5,
-  # which is already past its own patched version.
-  "brace-expansion@1": "^1.1.17"
-
-# pnpm 11 quarantines releases younger than 24h and enforces it on
-# `--frozen-lockfile`, so CI cannot install these without the exemption.
-# Delete each entry once the package ages past the window.
-minimumReleaseAgeExclude:
-  - eslint-plugin-safe-jsx@1.3.5
-  - magic-codemods@1.1.0
-  - magic-modal@10.2.0
-  - magic-oxfmt-config@1.2.0
-  - magic-oxlint-config@2.0.0
-  - magic-oxlint-plugin@1.2.0
-  - magic-tsconfig@1.2.0
+  # GHSA-rgw5-rvv9-x895. Both brace-expansion branches in the tree need their
+  # bounded expansion fix. The 5.0.8 fix for the earlier advisory was incomplete.
+  "brace-expansion@1": "^1.1.18"
+  "brace-expansion@>=4.0.0 <5.0.9": "^5.0.9"
+  # GHSA-7p8r-x3mc-p8w7. commitlint reaches fast-uri through ajv.
+  "fast-uri@>=3.0.0 <3.1.5": "^3.1.5"