fix(security): patch fixable JS/TS vulnerabilities across all apps#305
Open
Nick Robinson (nickrobinson) wants to merge 1 commit into
Open
fix(security): patch fixable JS/TS vulnerabilities across all apps#305Nick Robinson (nickrobinson) wants to merge 1 commit into
Nick Robinson (nickrobinson) wants to merge 1 commit into
Conversation
Addresses all security vulnerabilities fixable via minor/patch bumps: electron: - vite 6.4.2 → 6.4.3 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3 — high) - undici 7.25.0 → 7.28.0 (GHSA-vmh5-mc38-953g, GHSA-p88m-4jfj-68fv — high) - js-yaml 4.1.1 → 4.3.0 (GHSA-h67p-54hq-rp68 — moderate) - @babel/core → 7.29.7 (GHSA-4x5r-pxfx-6jf8 — low) javascript-web: - vite 6.4.2 → 6.4.3 (same vite CVEs — high) - js-yaml 4.1.1 → 4.3.0 (GHSA-h67p-54hq-rp68 — moderate) javascript-tui: - js-yaml 4.1.1 → 4.3.0 (GHSA-h67p-54hq-rp68 — moderate) - @babel/core → 7.29.7 (GHSA-4x5r-pxfx-6jf8 — low) react-native (package.json overrides + yarn.lock): - js-yaml override: 4.1.1 → 4.3.0 (GHSA-h67p-54hq-rp68 — moderate) - qs override: 6.14.2 → 6.15.3 (GHSA-q8mj-m7cp-5q26 — moderate) - shell-quote → 1.10.0 (GHSA-w7jw-789q-3m8p — critical) - ws@^7: 7.5.10 → 7.5.13 (GHSA-96hv-2xvq-fx4p — high) - @babel/core → 7.29.7 (GHSA-4x5r-pxfx-6jf8 — low) react-native-expo (yarn.lock + package-lock.json): - shell-quote → 1.10.0 (GHSA-w7jw-789q-3m8p — critical) - ws@^7: 7.5.10 → 7.5.13 (GHSA-96hv-2xvq-fx4p — high) - ws@^6: 6.2.3 → 6.2.6 (GHSA-96hv-2xvq-fx4p — high) - form-data 4.0.5 → 4.0.6 (high) - qs → 6.15.2 (GHSA-q8mj-m7cp-5q26 — moderate) - @babel/core → 7.29.7 (GHSA-4x5r-pxfx-6jf8 — low) - js-yaml → 4.3.0 (GHSA-h67p-54hq-rp68 — moderate) Not patched (require major version bumps — out of scope): - react-native-expo: expo/uuid/xcode stack vulnerabilities require expo major version upgrade (55 → 46 is a downgrade; see notes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X4wQTrTtNfRTrpfzH9Na9a
Nick Robinson (nickrobinson)
requested review from
a team and
Kristopher Johnson (kristopherjohnson)
as code owners
July 20, 2026 18:49
Copilot started reviewing on behalf of
Nick Robinson (nickrobinson)
July 20, 2026 18:49
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates dependency lockfiles (and targeted overrides/resolutions where needed) across the JS/TS sample apps to pick up patched versions for known security advisories, aiming to reduce/clear npm audit/similar findings without changing app behavior.
Changes:
- Bumps vulnerable transitive dependencies (notably
vite,undici,shell-quote,ws,js-yaml,qs,@babel/*) via lockfile updates across the affected apps. - Adds/updates
react-native/package.jsonoverrides+resolutionsto force patchedjs-yamlandqs, with a regeneratedreact-native/yarn.lock. - Updates npm lockfiles for
electron,javascript-web,javascript-tui, andreact-native-expoto reflect patched dependency trees.
Reviewed changes
Copilot reviewed 1 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| react-native/yarn.lock | Updates Yarn v1 resolution graph for patched transitive packages (e.g., shell-quote, ws, js-yaml, qs, @babel/*). |
| react-native/package.json | Pins patched versions via overrides/resolutions (notably js-yaml and qs) for the React Native app. |
| react-native-expo/package-lock.json | Applies npm lockfile updates for patched transitive dependencies (Expo toolchain + ws, form-data, shell-quote, etc.). |
| javascript-web/package-lock.json | Updates npm lockfile to patched vite and js-yaml. |
| javascript-tui/package-lock.json | Updates npm lockfile to patched js-yaml/Babel ecosystem. |
| electron/package-lock.json | Updates npm lockfile to patched vite/undici and other transitive packages. |
Files not reviewed (4)
- electron/package-lock.json: Generated file
- javascript-tui/package-lock.json: Generated file
- javascript-web/package-lock.json: Generated file
- react-native-expo/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
24
to
40
| "overrides": { | ||
| "ajv": "6.14.0", | ||
| "brace-expansion": "1.1.13", | ||
| "fast-xml-parser": "5.7.3", | ||
| "js-yaml": "4.1.1", | ||
| "js-yaml": "4.3.0", | ||
| "lodash": "4.18.1", | ||
| "qs": "6.14.2", | ||
| "qs": "6.15.3", | ||
| "yaml": "2.8.3" | ||
| }, | ||
| "resolutions": { | ||
| "ajv": "6.14.0", | ||
| "brace-expansion": "1.1.13", | ||
| "fast-xml-parser": "5.7.3", | ||
| "js-yaml": "4.1.1", | ||
| "js-yaml": "4.3.0", | ||
| "lodash": "4.18.1", | ||
| "qs": "6.14.2", | ||
| "qs": "6.15.3", | ||
| "yaml": "2.8.3", |
Comment on lines
24
to
40
| "overrides": { | ||
| "ajv": "6.14.0", | ||
| "brace-expansion": "1.1.13", | ||
| "fast-xml-parser": "5.7.3", | ||
| "js-yaml": "4.1.1", | ||
| "js-yaml": "4.3.0", | ||
| "lodash": "4.18.1", | ||
| "qs": "6.14.2", | ||
| "qs": "6.15.3", | ||
| "yaml": "2.8.3" | ||
| }, | ||
| "resolutions": { | ||
| "ajv": "6.14.0", | ||
| "brace-expansion": "1.1.13", | ||
| "fast-xml-parser": "5.7.3", | ||
| "js-yaml": "4.1.1", | ||
| "js-yaml": "4.3.0", | ||
| "lodash": "4.18.1", | ||
| "qs": "6.14.2", | ||
| "qs": "6.15.3", | ||
| "yaml": "2.8.3", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches all security vulnerabilities addressable via minor/patch version bumps across the five JS/TS apps in the monorepo. Lock files updated; no public API or behavior changes.
electronelectronjavascript-webreact-nativereact-native-exporeact-nativereact-native-exporeact-native-expoelectron,javascript-web,javascript-tui,react-native,react-native-exporeact-native,react-native-expoWhat changed per app
electron/—npm audit fix --package-lock-only(0 vulns remaining)javascript-web/—npm audit fix --package-lock-only(0 vulns remaining)javascript-tui/—npm audit fix --package-lock-only(0 vulns remaining)react-native/— bumped pinnedjs-yamlandqsinpackage.jsonoverrides/resolutions, then regeneratedyarn.lock(0 security-fixable vulns remaining)react-native-expo/— updatedpackage-lock.jsonvianpm audit fix --package-lock-only;yarn.lockupdated for shell-quote, ws, form-data, qs, @babel/core, js-yamlNot patched (manual intervention required)
react-native-expo: 11 moderate vulnerabilities in theuuid → xcode → @expo/config-plugins → expochain. npm reports the fix asexpo@46.0.21which is a major downgrade from the current~55.0.15. These require a deliberate Expo SDK upgrade and are out of scope for automated minor/patch patching.Verification
All three npm-managed apps (
electron,javascript-web,javascript-tui) report0 vulnerabilitiesafter fix. The yarn-managed apps (react-native,react-native-expo) have their lock files updated to patched versions for every fixable advisory.Generated by Claude Code