Repository navigation
Resolve all 15 Dependabot alerts in mobile build tooling - #618
Merged
Merged
Conversation
- node-forge 1.4.0 -> 1.4.2 (lockfile only, within Expo's ^1.4.0): fixes 12 advisories, including GHSA-86w9 via canonical DigestInfo checks, so the local RSA backport is retired. - overrides: glob 14.0.3 (GHSA-3g3m) and minimatch 11.0.3 (GHSA-g3hv). Expo SDK 58 still declares glob ^13 / minimatch ^10, which have no fix. Breaking API changes checked against every Expo call site. - deepmerge 4.3.1 has no upstream fix: source-hashed backport so getKeys() never returns an own __proto__ key (GHSA-gcqx). - Regression tests for fixed versions, deepmerge poisoning, and Expo's glob/fingerprint matching under the new majors. Restores the fail-closed audit:security gate, which fails on main since the glob advisory was published. Build-time tooling only; nothing here ships in the app bundle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bundler-audit on main fails on advisories published today against loofah 2.25.2, nokogiri 1.19.4 and rails-html-sanitizer 1.7.1. Conservative update of only those three gems to loofah 2.25.3, nokogiri 1.19.7 and rails-html-sanitizer 1.7.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The test read /proc/loadavg and /proc/meminfo directly, so it failed on a Mac. HostVitals now reads /proc through one small method that the test stubs with fixed contents, checking the exact CPU and memory percentages instead of only their types. Disk and database size still come from the real host. The real /proc read still runs where /proc exists (Linux CI). A new test pins that an unreadable reading is nil. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Under a C/POSIX locale (a shell without LANG, as on some Macs) Ruby returns ENV values as binary, so a label such as "SER8 · Incus" did not equal the UTF-8 string and the platform overview test failed. The label is now read as UTF-8, and a value that is not valid UTF-8 shows as "Not configured" instead of raising. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PosPaymentReconciliationJob takes one machine-wide flock and skips its sweep when the lock is held. Parallel test workers shared that file, so when two PosCardPaymentTest cases ran the job at the same moment one silently did nothing. That intermittently failed the overlap test (line 72) and the rotation test (line 56) on main and on several PRs. The lock path is now one small method, and the tests point it at a temporary file per test. Holding the real lock from another process reproduces both failures on the old code, and they pass on the new. Production still uses tmp/locks/pos-payment-reconciliation.lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
techmore
marked this pull request as ready for review
November 3, 2026 00:59
techmore
added a commit
that referenced
this pull request
Nov 3, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 15 open Dependabot alerts (6 high, 5 moderate, 4 low). Every one is a transitive npm dependency of Expo's build tooling in
mobile/package-lock.json. None of these packages ship in the employee app bundle, and no gems or rootpackage.jsonpackages are affected.The mobile CI gate (
audit:security) currently fails onmainwithUnremediated advisory: GHSA-3g3m-2fjr-6pw4, because these advisories were published after the last mobile run on Oct 27. This PR makes it pass again.^1.4.0). This fixes 12 alerts. 1.4.2 also adds canonical DigestInfo re-encoding, the upstream fix for GHSA-86w9, which Dependabot still lists as "no fix" (Add community thread review with group discount codes #61). The local RSA backport is removed, and the existing forged-signature regression test now passes against unpatched 1.4.2.overrides. These are majors, the same pattern as the existing zod override. Expo SDK 58, including the latest 58.0.22, still declaresglob ^13/minimatch ^10, and neither line has a fix. The breaking changes were checked against every Expo call site (see below).security/backports.jsonmechanism.getKeys()no longer returns an own__proto__key.Alert → fix
<= 1.4.0)__proto__poisoning (no upstream fix)Reachability (all build-time only)
@expo/cli(self-signed dev-server certificates) and@expo/code-signing-certificates(EAS Update signing, not used by Rupert).expo start/export/prebuild, config plugins, metro watch folders and fingerprinting.expo startdoes passsignal: AbortSignal.timeout(5000), but only over the project's own files.@expo/fingerprintignore patterns, which come from Expo and the project.@expo/configmerges the project's own app config.Major-bump compatibility check
makeRe(),Minimatch#regexp,AST,matchOne()and thedebugoption. Nothing in@expo/*uses them. Fingerprint uses onlynew Minimatch(),.match(),.patternand.negate.ignorepatterns that start with/(none of Expo's do), returns arrays from the internalGlobWalker, and removesdebug. Expo uses onlyglob()/globSync()withcwd,ignore,absolute,dot,nodirandsignal.signalandignore), an aborted walk, and fingerprintisIgnoredPath, including negation.Verification (local, Node 22.23.1)
node ../bin/check-mobile-sdk.mjs --self-testand the check itself: pass (Expo 58.0.17, 9 packages)npm run verify:security,typecheck,npm test(15/15, including 3 new ones) andaudit:security(0 unremediated): passexpo-doctor@1.21.4(with CI'sEXPO_DOCTOR_SKIP_DEPENDENCY_VERSION_CHECK=1) andnpm run export(iOS and Android, Hermes): pass (Doctor 19/19, both platforms exported)Known and pre-existing, not changed here: the online
expo install --check(npm run check:dependencies) reports Expo patch drift (expo 58.0.22, react-native 0.88.1, expo-system-ui 58.0.7, and the lockfile's typescript 7.0.2 against~6.0.3). That is identical onmainand is the job of Dependabot #598/#599.No migrations, web code or app source are touched.
🤖 Generated with Claude Code