From de1b79d4c240b1cfecbc44046095f7b4694c62a4 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 28 Mar 2026 03:57:00 +0000 Subject: [PATCH 1/2] fix: resolve socket.dev security warnings via pnpm overrides Add pnpm.overrides to force patched versions of vulnerable transitive dependencies: fast-xml-parser, node-forge, undici, tar, minimatch, picomatch, and brace-expansion. https://claude.ai/code/session_01YLnaP1E1tMzpnACcD3A6nN --- package.json | 11 ++ pnpm-lock.yaml | 272 +++++++++++++++++++------------------------------ 2 files changed, 118 insertions(+), 165 deletions(-) diff --git a/package.json b/package.json index 604595e..9811b52 100644 --- a/package.json +++ b/package.json @@ -106,6 +106,17 @@ "react-native-device-info": "^14.0.0", "typescript": "^5.7.3" }, + "pnpm": { + "overrides": { + "fast-xml-parser": ">=4.5.5", + "node-forge": ">=1.4.0", + "undici": ">=6.24.1", + "tar": ">=7.5.13", + "minimatch": ">=10.2.4", + "picomatch": ">=4.0.4", + "brace-expansion": ">=2.0.2" + } + }, "react-native-builder-bob": { "source": "src", "output": "lib", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bd46620..9dd38b7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,15 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + fast-xml-parser: '>=4.5.5' + node-forge: '>=1.4.0' + undici: '>=6.24.1' + tar: '>=7.5.13' + minimatch: '>=10.2.4' + picomatch: '>=4.0.4' + brace-expansion: '>=2.0.2' + importers: .: @@ -448,12 +457,6 @@ packages: peerDependencies: '@babel/core': ^7.0.0-0 - '@babel/plugin-transform-async-generator-functions@7.28.6': - resolution: {integrity: sha512-9knsChgsMzBV5Yh3kkhrZNxH3oCYAfMBkNNaVN4cP2RVlFPe8wYdwwcnOsAbkdDoV9UjFtOXWrWB52M8W4jNeA==} - engines: {node: '>=6.9.0'} - peerDependencies: - '@babel/core': ^7.0.0-0 - '@babel/plugin-transform-async-generator-functions@7.29.0': resolution: {integrity: sha512-va0VdWro4zlBr2JsXC+ofCPB2iG12wPtVGTWFx2WLDOM3nYQZZIGP82qku2eW/JR83sD+k2k+CsNtyEbUqhU6w==} engines: {node: '>=6.9.0'} @@ -730,12 +733,6 @@ packages: peerDependencies: '@babel/core': ^7.0.0-0 - '@babel/plugin-transform-regenerator@7.28.6': - resolution: {integrity: sha512-eZhoEZHYQLL5uc1gS5e9/oTknS0sSSAtd5TkKMUp3J+S/CaUjagc0kOUPsEbDmMeva0nC3WWl4SxVY6+OBuxfw==} - engines: {node: '>=6.9.0'} - peerDependencies: - '@babel/core': ^7.0.0-0 - '@babel/plugin-transform-regenerator@7.29.0': resolution: {integrity: sha512-FijqlqMA7DmRdg/aINBSs04y8XNTYw/lr1gJ2WsmBnnaNw1iS43EPkJW+zK7z65auG3AWRFXWj+NcTQwYptUog==} engines: {node: '>=6.9.0'} @@ -993,14 +990,6 @@ packages: '@hapi/topo@5.1.0': resolution: {integrity: sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==} - '@isaacs/balanced-match@4.0.1': - resolution: {integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==} - engines: {node: 20 || >=22} - - '@isaacs/brace-expansion@5.0.1': - resolution: {integrity: sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ==} - engines: {node: 20 || >=22} - '@isaacs/fs-minipass@4.0.1': resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} engines: {node: '>=18.0.0'} @@ -1592,8 +1581,9 @@ packages: peerDependencies: '@babel/core': ^7.0.0 - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} + balanced-match@4.0.4: + resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} + engines: {node: 18 || 20 || >=22} base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} @@ -1624,11 +1614,9 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} - - brace-expansion@2.0.2: - resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==} + brace-expansion@5.0.5: + resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} + engines: {node: 18 || 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -1799,9 +1787,6 @@ packages: resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} engines: {node: '>= 0.8.0'} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - connect@3.7.0: resolution: {integrity: sha512-ZqRXc+tZukToSNmh5C2iWMSoV3X1YUcPbqEM4DkEG5tNQXrQUZCNVGGv3IuicnkMtPfGf3Xtp8WCXs295iQ1pQ==} engines: {node: '>= 0.10.0'} @@ -2128,8 +2113,11 @@ packages: fast-json-stable-stringify@2.1.0: resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==} - fast-xml-parser@4.5.3: - resolution: {integrity: sha512-RKihhV+SHsIUGXObeVy9AXiBbFwkVk7Syp8XgwN5U3JV416+Gwp/GO9i0JYKmikykgz/UHRrrV4ROuZEo/T0ig==} + fast-xml-builder@1.1.4: + resolution: {integrity: sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==} + + fast-xml-parser@5.5.9: + resolution: {integrity: sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==} hasBin: true fastq@1.20.1: @@ -2142,7 +2130,7 @@ packages: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} engines: {node: '>=12.0.0'} peerDependencies: - picomatch: ^3 || ^4 + picomatch: '>=4.0.4' peerDependenciesMeta: picomatch: optional: true @@ -2745,24 +2733,28 @@ packages: engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] + libc: [glibc] lightningcss-linux-arm64-musl@1.31.1: resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] + libc: [musl] lightningcss-linux-x64-gnu@1.31.1: resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] + libc: [glibc] lightningcss-linux-x64-musl@1.31.1: resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] + libc: [musl] lightningcss-win32-arm64-msvc@1.31.1: resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==} @@ -3005,20 +2997,9 @@ packages: resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==} engines: {node: '>=6'} - minimatch@10.1.2: - resolution: {integrity: sha512-fu656aJ0n2kcXwsnwnv9g24tkU5uSmOlTjd6WyyaKm2Z+h1qmY6bAjrcaIxF/BslFqbZ8UBtbJi7KgQOZD2PTw==} - engines: {node: 20 || >=22} - - minimatch@3.1.2: - resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==} - - minimatch@5.1.6: - resolution: {integrity: sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==} - engines: {node: '>=10'} - - minimatch@9.0.5: - resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==} - engines: {node: '>=16 || 14 >=14.17'} + minimatch@10.2.4: + resolution: {integrity: sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==} + engines: {node: 18 || 20 || >=22} minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -3099,8 +3080,8 @@ packages: encoding: optional: true - node-forge@1.3.3: - resolution: {integrity: sha512-rLvcdSyRCyouf6jcOIPe/BgwG/d7hKjzMKOas33/pHEr6gbq18IK9zV7DiPvzsz0oBJPme6qr6H6kGZuI9/DZg==} + node-forge@1.4.0: + resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==} engines: {node: '>= 6.13.0'} node-int64@0.4.0: @@ -3247,6 +3228,10 @@ packages: resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==} engines: {node: '>=8'} + path-expression-matcher@1.2.0: + resolution: {integrity: sha512-DwmPWeFn+tq7TiyJ2CxezCAirXjFxvaiD03npak3cRjlP9+OjTmSy1EpIrEbh+l6JgUundniloMLDQ/6VTdhLQ==} + engines: {node: '>=14.0.0'} + path-is-absolute@1.0.1: resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==} engines: {node: '>=0.10.0'} @@ -3269,16 +3254,8 @@ packages: picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} - picomatch@2.3.1: - resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==} - engines: {node: '>=8.6'} - - picomatch@3.0.1: - resolution: {integrity: sha512-I3EurrIQMlRc9IaAZnqRR044Phh2DXY+55o7uJ0V+hYZAcQYSuFWsc9q5PvyDHUSCe1Qxn/iBz+78s86zWnGag==} - engines: {node: '>=10'} - - picomatch@4.0.3: - resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==} + picomatch@4.0.4: + resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} pify@4.0.1: @@ -3689,8 +3666,8 @@ packages: resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==} engines: {node: '>=8'} - strnum@1.1.2: - resolution: {integrity: sha512-vrN+B7DBIoTTZjnPNewwhx6cBA/H+IS7rfW68n7XxC1y7uoiGQBxaKzqucGUgavX15dJgiGztLJ8vxuEzwqBdA==} + strnum@2.2.2: + resolution: {integrity: sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==} structured-headers@0.4.1: resolution: {integrity: sha512-0MP/Cxx5SzeeZ10p/bZI0S6MpgD+yxAhi1BOQ34jgnMXsCq3j1t6tQnZu+KdlL7dvJTLT3g9xN8tl10TqgFMcg==} @@ -3724,8 +3701,8 @@ packages: resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==} engines: {node: '>= 0.4'} - tar@7.5.7: - resolution: {integrity: sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==} + tar@7.5.13: + resolution: {integrity: sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==} engines: {node: '>=18'} temp-dir@2.0.0: @@ -3814,9 +3791,9 @@ packages: undici-types@7.16.0: resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==} - undici@6.23.0: - resolution: {integrity: sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==} - engines: {node: '>=18.17'} + undici@7.24.6: + resolution: {integrity: sha512-Xi4agocCbRzt0yYMZGMA6ApD7gvtUFaxm4ZmeacWI4cZxaF6C+8I8QfofC20NAePiB/IcvZmzkJ7XPa471AEtA==} + engines: {node: '>=20.18.1'} unicode-canonical-property-names-ecmascript@2.0.1: resolution: {integrity: sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg==} @@ -4501,15 +4478,6 @@ snapshots: '@babel/core': 7.28.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-transform-async-generator-functions@7.28.6(@babel/core@7.28.6)': - dependencies: - '@babel/core': 7.28.6 - '@babel/helper-plugin-utils': 7.28.6 - '@babel/helper-remap-async-to-generator': 7.27.1(@babel/core@7.28.6) - '@babel/traverse': 7.28.6 - transitivePeerDependencies: - - supports-color - '@babel/plugin-transform-async-generator-functions@7.29.0(@babel/core@7.28.6)': dependencies: '@babel/core': 7.28.6 @@ -4822,11 +4790,6 @@ snapshots: '@babel/helper-annotate-as-pure': 7.27.3 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-transform-regenerator@7.28.6(@babel/core@7.28.6)': - dependencies: - '@babel/core': 7.28.6 - '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-transform-regenerator@7.29.0(@babel/core@7.28.6)': dependencies: '@babel/core': 7.28.6 @@ -5123,11 +5086,11 @@ snapshots: getenv: 2.0.0 glob: 13.0.1 lan-network: 0.1.7 - minimatch: 9.0.5 - node-forge: 1.3.3 + minimatch: 10.2.4 + node-forge: 1.4.0 npm-package-arg: 11.0.3 ora: 3.4.0 - picomatch: 3.0.1 + picomatch: 4.0.4 pretty-bytes: 5.6.0 pretty-format: 29.7.0 progress: 2.0.3 @@ -5144,9 +5107,9 @@ snapshots: source-map-support: 0.5.21 stacktrace-parser: 0.1.11 structured-headers: 0.4.1 - tar: 7.5.7 + tar: 7.5.13 terminal-link: 2.1.1 - undici: 6.23.0 + undici: 7.24.6 wrap-ansi: 7.0.0 ws: 8.18.3 optionalDependencies: @@ -5159,7 +5122,7 @@ snapshots: '@expo/code-signing-certificates@0.0.6': dependencies: - node-forge: 1.3.3 + node-forge: 1.4.0 '@expo/config-plugins@54.0.4': dependencies: @@ -5233,7 +5196,7 @@ snapshots: getenv: 2.0.0 glob: 13.0.1 ignore: 5.3.2 - minimatch: 9.0.5 + minimatch: 10.2.4 p-limit: 3.1.0 resolve-from: 5.0.0 semver: 7.7.3 @@ -5260,9 +5223,9 @@ snapshots: '@expo/metro-config@54.0.14(expo@54.0.33(@babel/core@7.28.6)(react-native@0.73.11(@babel/core@7.28.6)(@babel/preset-env@7.29.0(@babel/core@7.28.6))(react@18.3.1))(react@18.3.1))': dependencies: - '@babel/code-frame': 7.28.6 + '@babel/code-frame': 7.29.0 '@babel/core': 7.28.6 - '@babel/generator': 7.28.6 + '@babel/generator': 7.29.0 '@expo/config': 12.0.13 '@expo/env': 2.0.8 '@expo/json-file': 10.0.8 @@ -5278,7 +5241,7 @@ snapshots: hermes-parser: 0.29.1 jsc-safe-url: 0.2.4 lightningcss: 1.31.1 - minimatch: 9.0.5 + minimatch: 10.2.4 postcss: 8.4.49 resolve-from: 5.0.0 optionalDependencies: @@ -5365,7 +5328,7 @@ snapshots: '@expo/xcpretty@4.4.0': dependencies: - '@babel/code-frame': 7.28.6 + '@babel/code-frame': 7.29.0 chalk: 4.1.2 js-yaml: 4.1.1 @@ -5375,12 +5338,6 @@ snapshots: dependencies: '@hapi/hoek': 9.3.0 - '@isaacs/balanced-match@4.0.1': {} - - '@isaacs/brace-expansion@5.0.1': - dependencies: - '@isaacs/balanced-match': 4.0.1 - '@isaacs/fs-minipass@4.0.1': dependencies: minipass: 7.1.2 @@ -5684,7 +5641,7 @@ snapshots: '@react-native-community/cli-tools': 12.3.7 chalk: 4.1.2 execa: 5.1.1 - fast-xml-parser: 4.5.3 + fast-xml-parser: 5.5.9 glob: 7.2.3 logkitty: 0.7.1 transitivePeerDependencies: @@ -5695,7 +5652,7 @@ snapshots: '@react-native-community/cli-tools': 12.3.7 chalk: 4.1.2 execa: 5.1.1 - fast-xml-parser: 4.5.3 + fast-xml-parser: 5.5.9 glob: 7.2.3 ora: 5.4.1 transitivePeerDependencies: @@ -5781,7 +5738,7 @@ snapshots: '@react-native/babel-plugin-codegen@0.81.5(@babel/core@7.28.6)': dependencies: - '@babel/traverse': 7.28.6 + '@babel/traverse': 7.29.0 '@react-native/codegen': 0.81.5(@babel/core@7.28.6) transitivePeerDependencies: - '@babel/core' @@ -5844,7 +5801,7 @@ snapshots: '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.28.6) '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.28.6) '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.28.6) - '@babel/plugin-transform-async-generator-functions': 7.28.6(@babel/core@7.28.6) + '@babel/plugin-transform-async-generator-functions': 7.29.0(@babel/core@7.28.6) '@babel/plugin-transform-async-to-generator': 7.28.6(@babel/core@7.28.6) '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.28.6) '@babel/plugin-transform-class-properties': 7.28.6(@babel/core@7.28.6) @@ -5857,7 +5814,7 @@ snapshots: '@babel/plugin-transform-literals': 7.27.1(@babel/core@7.28.6) '@babel/plugin-transform-logical-assignment-operators': 7.28.6(@babel/core@7.28.6) '@babel/plugin-transform-modules-commonjs': 7.28.6(@babel/core@7.28.6) - '@babel/plugin-transform-named-capturing-groups-regex': 7.27.1(@babel/core@7.28.6) + '@babel/plugin-transform-named-capturing-groups-regex': 7.29.0(@babel/core@7.28.6) '@babel/plugin-transform-nullish-coalescing-operator': 7.28.6(@babel/core@7.28.6) '@babel/plugin-transform-numeric-separator': 7.28.6(@babel/core@7.28.6) '@babel/plugin-transform-object-rest-spread': 7.28.6(@babel/core@7.28.6) @@ -5870,7 +5827,7 @@ snapshots: '@babel/plugin-transform-react-jsx': 7.28.6(@babel/core@7.28.6) '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.6) '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.28.6) - '@babel/plugin-transform-regenerator': 7.28.6(@babel/core@7.28.6) + '@babel/plugin-transform-regenerator': 7.29.0(@babel/core@7.28.6) '@babel/plugin-transform-runtime': 7.28.5(@babel/core@7.28.6) '@babel/plugin-transform-shorthand-properties': 7.27.1(@babel/core@7.28.6) '@babel/plugin-transform-spread': 7.28.6(@babel/core@7.28.6) @@ -5901,7 +5858,7 @@ snapshots: '@react-native/codegen@0.81.5(@babel/core@7.28.6)': dependencies: '@babel/core': 7.28.6 - '@babel/parser': 7.28.6 + '@babel/parser': 7.29.0 glob: 7.2.3 hermes-parser: 0.29.1 invariant: 2.2.4 @@ -6189,7 +6146,7 @@ snapshots: anymatch@3.1.3: dependencies: normalize-path: 3.0.0 - picomatch: 2.3.1 + picomatch: 4.0.4 appdirsjs@1.2.7: {} @@ -6281,7 +6238,7 @@ snapshots: babel-plugin-react-compiler@1.0.0: dependencies: - '@babel/types': 7.28.6 + '@babel/types': 7.29.0 babel-plugin-react-native-web@0.21.2: {} @@ -6352,7 +6309,7 @@ snapshots: babel-plugin-jest-hoist: 29.6.3 babel-preset-current-node-syntax: 1.2.0(@babel/core@7.28.6) - balanced-match@1.0.2: {} + balanced-match@4.0.4: {} base64-js@1.5.1: {} @@ -6382,14 +6339,9 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@1.1.12: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - - brace-expansion@2.0.2: + brace-expansion@5.0.5: dependencies: - balanced-match: 1.0.2 + balanced-match: 4.0.4 braces@3.0.3: dependencies: @@ -6564,8 +6516,6 @@ snapshots: transitivePeerDependencies: - supports-color - concat-map@0.0.1: {} - connect@3.7.0: dependencies: debug: 2.6.9 @@ -6895,9 +6845,15 @@ snapshots: fast-json-stable-stringify@2.1.0: {} - fast-xml-parser@4.5.3: + fast-xml-builder@1.1.4: + dependencies: + path-expression-matcher: 1.2.0 + + fast-xml-parser@5.5.9: dependencies: - strnum: 1.1.2 + fast-xml-builder: 1.1.4 + path-expression-matcher: 1.2.0 + strnum: 2.2.2 fastq@1.20.1: dependencies: @@ -6907,9 +6863,9 @@ snapshots: dependencies: bser: 2.1.1 - fdir@6.5.0(picomatch@4.0.3): + fdir@6.5.0(picomatch@4.0.4): optionalDependencies: - picomatch: 4.0.3 + picomatch: 4.0.4 fill-range@7.1.1: dependencies: @@ -6996,7 +6952,7 @@ snapshots: glob@13.0.1: dependencies: - minimatch: 10.1.2 + minimatch: 10.2.4 minipass: 7.1.2 path-scurry: 2.0.1 @@ -7005,7 +6961,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.2 + minimatch: 10.2.4 once: 1.4.0 path-is-absolute: 1.0.1 @@ -7014,7 +6970,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 5.1.6 + minimatch: 10.2.4 once: 1.4.0 global-dirs@0.1.1: @@ -7522,7 +7478,7 @@ snapshots: chalk: 4.1.2 ci-info: 3.9.0 graceful-fs: 4.2.11 - picomatch: 2.3.1 + picomatch: 4.0.4 jest-validate@29.7.0: dependencies: @@ -7927,9 +7883,9 @@ snapshots: metro-source-map@0.83.3: dependencies: - '@babel/traverse': 7.28.6 - '@babel/traverse--for-generate-function-map': '@babel/traverse@7.28.6' - '@babel/types': 7.28.6 + '@babel/traverse': 7.29.0 + '@babel/traverse--for-generate-function-map': '@babel/traverse@7.29.0' + '@babel/types': 7.29.0 flow-enums-runtime: 0.0.6 invariant: 2.2.4 metro-symbolicate: 0.83.3 @@ -7977,9 +7933,9 @@ snapshots: metro-transform-plugins@0.83.3: dependencies: '@babel/core': 7.28.6 - '@babel/generator': 7.28.6 + '@babel/generator': 7.29.0 '@babel/template': 7.28.6 - '@babel/traverse': 7.28.6 + '@babel/traverse': 7.29.0 flow-enums-runtime: 0.0.6 nullthrows: 1.1.1 transitivePeerDependencies: @@ -8008,9 +7964,9 @@ snapshots: metro-transform-worker@0.83.3: dependencies: '@babel/core': 7.28.6 - '@babel/generator': 7.28.6 - '@babel/parser': 7.28.6 - '@babel/types': 7.28.6 + '@babel/generator': 7.29.0 + '@babel/parser': 7.29.0 + '@babel/types': 7.29.0 flow-enums-runtime: 0.0.6 metro: 0.83.3 metro-babel-transformer: 0.83.3 @@ -8076,13 +8032,13 @@ snapshots: metro@0.83.3: dependencies: - '@babel/code-frame': 7.28.6 + '@babel/code-frame': 7.29.0 '@babel/core': 7.28.6 - '@babel/generator': 7.28.6 - '@babel/parser': 7.28.6 + '@babel/generator': 7.29.0 + '@babel/parser': 7.29.0 '@babel/template': 7.28.6 - '@babel/traverse': 7.28.6 - '@babel/types': 7.28.6 + '@babel/traverse': 7.29.0 + '@babel/types': 7.29.0 accepts: 1.3.8 chalk: 4.1.2 ci-info: 2.0.0 @@ -8124,7 +8080,7 @@ snapshots: micromatch@4.0.8: dependencies: braces: 3.0.3 - picomatch: 2.3.1 + picomatch: 4.0.4 mime-db@1.52.0: {} @@ -8142,21 +8098,9 @@ snapshots: mimic-fn@2.1.0: {} - minimatch@10.1.2: - dependencies: - '@isaacs/brace-expansion': 5.0.1 - - minimatch@3.1.2: - dependencies: - brace-expansion: 1.1.12 - - minimatch@5.1.6: - dependencies: - brace-expansion: 2.0.2 - - minimatch@9.0.5: + minimatch@10.2.4: dependencies: - brace-expansion: 2.0.2 + brace-expansion: 5.0.5 minimist@1.2.8: {} @@ -8204,13 +8148,13 @@ snapshots: node-dir@0.1.17: dependencies: - minimatch: 3.1.2 + minimatch: 10.2.4 node-fetch@2.7.0: dependencies: whatwg-url: 5.0.0 - node-forge@1.3.3: {} + node-forge@1.4.0: {} node-int64@0.4.0: {} @@ -8368,6 +8312,8 @@ snapshots: path-exists@4.0.0: {} + path-expression-matcher@1.2.0: {} + path-is-absolute@1.0.1: {} path-key@3.1.1: {} @@ -8383,11 +8329,7 @@ snapshots: picocolors@1.1.1: {} - picomatch@2.3.1: {} - - picomatch@3.0.1: {} - - picomatch@4.0.3: {} + picomatch@4.0.4: {} pify@4.0.1: {} @@ -8844,7 +8786,7 @@ snapshots: strip-json-comments@3.1.1: {} - strnum@1.1.2: {} + strnum@2.2.2: {} structured-headers@0.4.1: {} @@ -8879,7 +8821,7 @@ snapshots: supports-preserve-symlinks-flag@1.0.0: {} - tar@7.5.7: + tar@7.5.13: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 @@ -8909,7 +8851,7 @@ snapshots: dependencies: '@istanbuljs/schema': 0.1.3 glob: 7.2.3 - minimatch: 3.1.2 + minimatch: 10.2.4 thenify-all@1.6.0: dependencies: @@ -8928,8 +8870,8 @@ snapshots: tinyglobby@0.2.15: dependencies: - fdir: 6.5.0(picomatch@4.0.3) - picomatch: 4.0.3 + fdir: 6.5.0(picomatch@4.0.4) + picomatch: 4.0.4 tmpl@1.0.5: {} @@ -8959,7 +8901,7 @@ snapshots: undici-types@7.16.0: {} - undici@6.23.0: {} + undici@7.24.6: {} unicode-canonical-property-names-ecmascript@2.0.1: {} From 0d3942671d9c41afd1bc60c08d0af779ce347f5f Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 28 Mar 2026 04:29:43 +0000 Subject: [PATCH 2/2] fix: use bounded same-major overrides for transitive dependency CVEs The previous unbounded overrides caused CI failures: - minimatch v10 broke test-exclude@6 (removed default export) - undici v7 raised Node minimum to >=20.18.1 (breaks Node 18) - brace-expansion v5 broke minimatch@5 (different API) Use bounded version ranges (e.g. ">=3.1.5 <4") to keep each consumer on its compatible major line while bumping to patched versions. Remove brace-expansion override as no same-major fix exists. https://claude.ai/code/session_01YLnaP1E1tMzpnACcD3A6nN --- package.json | 12 ++++-- pnpm-lock.yaml | 106 +++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 93 insertions(+), 25 deletions(-) diff --git a/package.json b/package.json index 9811b52..263e248 100644 --- a/package.json +++ b/package.json @@ -110,11 +110,15 @@ "overrides": { "fast-xml-parser": ">=4.5.5", "node-forge": ">=1.4.0", - "undici": ">=6.24.1", + "undici": ">=6.24.1 <7", "tar": ">=7.5.13", - "minimatch": ">=10.2.4", - "picomatch": ">=4.0.4", - "brace-expansion": ">=2.0.2" + "minimatch@3": ">=3.1.5 <4", + "minimatch@5": ">=5.1.9 <6", + "minimatch@9": ">=9.0.9 <10", + "minimatch@10": ">=10.2.4", + "picomatch@2": ">=2.3.2 <3", + "picomatch@3": ">=3.0.2 <4", + "picomatch@4": ">=4.0.4" } }, "react-native-builder-bob": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 9dd38b7..49469f1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,11 +7,15 @@ settings: overrides: fast-xml-parser: '>=4.5.5' node-forge: '>=1.4.0' - undici: '>=6.24.1' + undici: '>=6.24.1 <7' tar: '>=7.5.13' - minimatch: '>=10.2.4' - picomatch: '>=4.0.4' - brace-expansion: '>=2.0.2' + minimatch@3: '>=3.1.5 <4' + minimatch@5: '>=5.1.9 <6' + minimatch@9: '>=9.0.9 <10' + minimatch@10: '>=10.2.4' + picomatch@2: '>=2.3.2 <3' + picomatch@3: '>=3.0.2 <4' + picomatch@4: '>=4.0.4' importers: @@ -1581,6 +1585,9 @@ packages: peerDependencies: '@babel/core': ^7.0.0 + balanced-match@1.0.2: + resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} + balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -1614,6 +1621,12 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} + brace-expansion@1.1.12: + resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} + + brace-expansion@2.0.2: + resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==} + brace-expansion@5.0.5: resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} engines: {node: 18 || 20 || >=22} @@ -1787,6 +1800,9 @@ packages: resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} engines: {node: '>= 0.8.0'} + concat-map@0.0.1: + resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} + connect@3.7.0: resolution: {integrity: sha512-ZqRXc+tZukToSNmh5C2iWMSoV3X1YUcPbqEM4DkEG5tNQXrQUZCNVGGv3IuicnkMtPfGf3Xtp8WCXs295iQ1pQ==} engines: {node: '>= 0.10.0'} @@ -2130,7 +2146,7 @@ packages: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} engines: {node: '>=12.0.0'} peerDependencies: - picomatch: '>=4.0.4' + picomatch: '>=3.0.2 <4' peerDependenciesMeta: picomatch: optional: true @@ -3001,6 +3017,17 @@ packages: resolution: {integrity: sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==} engines: {node: 18 || 20 || >=22} + minimatch@3.1.5: + resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} + + minimatch@5.1.9: + resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==} + engines: {node: '>=10'} + + minimatch@9.0.9: + resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==} + engines: {node: '>=16 || 14 >=14.17'} + minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -3254,6 +3281,14 @@ packages: picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} + picomatch@2.3.2: + resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==} + engines: {node: '>=8.6'} + + picomatch@3.0.2: + resolution: {integrity: sha512-cfDHL6LStTEKlNilboNtobT/kEa30PtAf2Q1OgszfrG/rpVl1xaFWT9ktfkS306GmHgmnad1Sw4wabhlvFtsTw==} + engines: {node: '>=10'} + picomatch@4.0.4: resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} @@ -3791,9 +3826,9 @@ packages: undici-types@7.16.0: resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==} - undici@7.24.6: - resolution: {integrity: sha512-Xi4agocCbRzt0yYMZGMA6ApD7gvtUFaxm4ZmeacWI4cZxaF6C+8I8QfofC20NAePiB/IcvZmzkJ7XPa471AEtA==} - engines: {node: '>=20.18.1'} + undici@6.24.1: + resolution: {integrity: sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==} + engines: {node: '>=18.17'} unicode-canonical-property-names-ecmascript@2.0.1: resolution: {integrity: sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg==} @@ -5086,11 +5121,11 @@ snapshots: getenv: 2.0.0 glob: 13.0.1 lan-network: 0.1.7 - minimatch: 10.2.4 + minimatch: 9.0.9 node-forge: 1.4.0 npm-package-arg: 11.0.3 ora: 3.4.0 - picomatch: 4.0.4 + picomatch: 3.0.2 pretty-bytes: 5.6.0 pretty-format: 29.7.0 progress: 2.0.3 @@ -5109,7 +5144,7 @@ snapshots: structured-headers: 0.4.1 tar: 7.5.13 terminal-link: 2.1.1 - undici: 7.24.6 + undici: 6.24.1 wrap-ansi: 7.0.0 ws: 8.18.3 optionalDependencies: @@ -5196,7 +5231,7 @@ snapshots: getenv: 2.0.0 glob: 13.0.1 ignore: 5.3.2 - minimatch: 10.2.4 + minimatch: 9.0.9 p-limit: 3.1.0 resolve-from: 5.0.0 semver: 7.7.3 @@ -5241,7 +5276,7 @@ snapshots: hermes-parser: 0.29.1 jsc-safe-url: 0.2.4 lightningcss: 1.31.1 - minimatch: 10.2.4 + minimatch: 9.0.9 postcss: 8.4.49 resolve-from: 5.0.0 optionalDependencies: @@ -6146,7 +6181,7 @@ snapshots: anymatch@3.1.3: dependencies: normalize-path: 3.0.0 - picomatch: 4.0.4 + picomatch: 2.3.2 appdirsjs@1.2.7: {} @@ -6309,6 +6344,8 @@ snapshots: babel-plugin-jest-hoist: 29.6.3 babel-preset-current-node-syntax: 1.2.0(@babel/core@7.28.6) + balanced-match@1.0.2: {} + balanced-match@4.0.4: {} base64-js@1.5.1: {} @@ -6339,6 +6376,15 @@ snapshots: dependencies: big-integer: 1.6.52 + brace-expansion@1.1.12: + dependencies: + balanced-match: 1.0.2 + concat-map: 0.0.1 + + brace-expansion@2.0.2: + dependencies: + balanced-match: 1.0.2 + brace-expansion@5.0.5: dependencies: balanced-match: 4.0.4 @@ -6516,6 +6562,8 @@ snapshots: transitivePeerDependencies: - supports-color + concat-map@0.0.1: {} + connect@3.7.0: dependencies: debug: 2.6.9 @@ -6961,7 +7009,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 10.2.4 + minimatch: 3.1.5 once: 1.4.0 path-is-absolute: 1.0.1 @@ -6970,7 +7018,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 10.2.4 + minimatch: 5.1.9 once: 1.4.0 global-dirs@0.1.1: @@ -7478,7 +7526,7 @@ snapshots: chalk: 4.1.2 ci-info: 3.9.0 graceful-fs: 4.2.11 - picomatch: 4.0.4 + picomatch: 2.3.2 jest-validate@29.7.0: dependencies: @@ -8080,7 +8128,7 @@ snapshots: micromatch@4.0.8: dependencies: braces: 3.0.3 - picomatch: 4.0.4 + picomatch: 2.3.2 mime-db@1.52.0: {} @@ -8102,6 +8150,18 @@ snapshots: dependencies: brace-expansion: 5.0.5 + minimatch@3.1.5: + dependencies: + brace-expansion: 1.1.12 + + minimatch@5.1.9: + dependencies: + brace-expansion: 2.0.2 + + minimatch@9.0.9: + dependencies: + brace-expansion: 2.0.2 + minimist@1.2.8: {} minipass@7.1.2: {} @@ -8148,7 +8208,7 @@ snapshots: node-dir@0.1.17: dependencies: - minimatch: 10.2.4 + minimatch: 3.1.5 node-fetch@2.7.0: dependencies: @@ -8329,6 +8389,10 @@ snapshots: picocolors@1.1.1: {} + picomatch@2.3.2: {} + + picomatch@3.0.2: {} + picomatch@4.0.4: {} pify@4.0.1: {} @@ -8851,7 +8915,7 @@ snapshots: dependencies: '@istanbuljs/schema': 0.1.3 glob: 7.2.3 - minimatch: 10.2.4 + minimatch: 3.1.5 thenify-all@1.6.0: dependencies: @@ -8901,7 +8965,7 @@ snapshots: undici-types@7.16.0: {} - undici@7.24.6: {} + undici@6.24.1: {} unicode-canonical-property-names-ecmascript@2.0.1: {}