fix: resolve security alerts (#464)

Author: thymikee

android-snapshot-helper/AndroidManifest.xml

@@ -4,8 +4,9 @@
     <uses-sdk android:minSdkVersion="23" android:targetSdkVersion="36" />
 
     <application
-        android:debuggable="true"
+        android:debuggable="false"
         android:label="Agent Device Snapshot Helper"
+        android:testOnly="true"
         android:theme="@android:style/Theme.NoDisplay" />
 
     <instrumentation

android-snapshot-helper/README.md

@@ -36,7 +36,7 @@ adb shell am instrument -w \
 ```
 
 `maxDepth` also caps recursive traversal depth inside the helper.
-The `-t` install flag is required because the helper is a debuggable instrumentation/test APK.
+The `-t` install flag is required because the helper is a test-only instrumentation APK.
 Devices or providers that block test-package installs must allow this package before helper capture
 can run.
 

examples/test-app/package.json

@@ -25,5 +25,12 @@
   "devDependencies": {
     "@types/react": "~19.2.2",
     "typescript": "~5.9.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "@xmldom/xmldom": "0.8.13",
+      "postcss": "8.5.12",
+      "uuid": "14.0.0"
+    }
   }
 }

examples/test-app/pnpm-lock.yaml

@@ -151,7 +151,7 @@
     "performance"
   ],
   "dependencies": {
-    "fast-xml-parser": "^5.5.10",
+    "fast-xml-parser": "^5.7.2",
     "pngjs": "^7.0.0"
   },
   "devDependencies": {
@@ -164,6 +164,6 @@
     "oxlint": "^1.57.0",
     "skillgym": "^0.5.0",
     "typescript": "^6.0.2",
-    "vite": "^8.0.7"
+    "vite": "^8.0.10"
   }
 }