chore(deps): close all 26 open critical/high Dependabot alerts (tar, nanoid, undici, ip-address, fast-uri, js-yaml, brace-expansion, postcss, shell-quote)

[romainsalles]

Why

Vanta SOC 2 test packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high is failing. This PR now closes all 26 open critical/high Dependabot alerts on this repo — all transitive, all dev/test tooling (nothing in the published SDK). Originally opened for 10 HIGH alerts; updated 2026-08-17 to cover the CVEs that landed since (tar CRITICAL, nanoid, undici, ip-address, fast-uri, js-yaml, brace-expansion 1.1.18).

What

Root yarn.lock (resolutions, yarn 3.6.1):

Alerts	Package	Resolution	Locked at
#731 (CRITICAL), #730	tar	>=7.5.19	7.5.22
#775, #774	nanoid	>=3.3.18 <4.0.0 (new)	3.3.18
#772, #743, #726	brace-expansion	~1.1.18	1.1.18
#739	js-yaml	>=5.2.2	5.2.2
#758	ip-address	>=10.3.1	10.5.0
#753	undici	>=7.29.0 <8.0.0	7.29.0

brace-expansion stays on the 1.x line here (minimatch ~3.1.3 can't consume 5.x); CVE-2026-14257 is now patched on 1.x via 1.1.17/1.1.18, so the earlier "not fixable" note about the root 1.x line no longer applies.

test-projects/expo-purchasely-test (npm overrides):

Alerts	Package	Override	Locked at
#719 (CRITICAL), #718	tar	>=7.5.18	7.5.22
#776, #769	nanoid	^3.3.18 (new)	3.3.18
#767, #715	js-yaml	^4.3.1	4.3.1
#765, #742, #714	brace-expansion	>=5.0.8 (no 1.x left in lock)	5.0.8
#745	undici	^8.9.0	8.10.0
#744	fast-uri	>=4.1.2	4.1.2
#734	postcss	>=8.5.18	8.5.24

test-projects/rn-purchasely-test (npm overrides):

Alerts	Package	Override	Locked at
#771, #770, #723	js-yaml	^4.3.1 (3.x lifted to 4.x)	4.3.1
#724	shell-quote	>=1.9.0	1.10.0

Supersedes Dependabot PRs

Merging this closes the alerts behind #271, #272, #273, #274, #275, #276, #277 (and earlier #269) — those can be closed.

Verification

Each lockfile re-checked after regeneration: every flagged package/major line is at or above its fix version (see tables). Lockfiles regenerated with yarn install --mode=update-lockfile (root) and npm install --package-lock-only --legacy-peer-deps (test projects).

Original verification (node 22, yarn 3.6.1): yarn install / yarn lint / yarn typecheck clean, yarn test 249 passing.

Heads-up on CI

build-ios is failing on this repo independently of dependencies — the example app fails to link with missing facebook::react::Props / DebugStringConvertible vtables out of libRNScreens.a (ld: symbol(s) not found for architecture arm64). Same failure on the Dependabot PRs; it does not touch any JS lockfile path and needs a separate fix before this can merge on a green board.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

Updates root and test-project dependency overrides and lockfiles to resolve high-severity Dependabot alerts.

• Raises patched versions of brace-expansion, js-yaml, tar, postcss, and shell-quote.
• Regenerates the Yarn and npm lockfiles with the overridden dependency versions.

Confidence Score: 5/5

The dependency updates appear safe to merge, with no concrete compatibility or behavioral failures identified.

The overridden versions resolve consistently in their respective lockfiles, and the relevant consumers retain compatible APIs, export shapes, and Node engine requirements.

Important Files Changed

Filename	Overview
package.json	Updates root resolutions for brace-expansion, js-yaml, and tar without an identified compatibility failure.
yarn.lock	Resolves the updated root dependency constraints to the intended patched versions.
test-projects/expo-purchasely-test/package.json	Updates Expo test-project overrides for patched brace-expansion, js-yaml, postcss, and tar versions.
test-projects/expo-purchasely-test/package-lock.json	Regenerates the Expo test-project dependency graph consistently with the changed overrides.
test-projects/rn-purchasely-test/package.json	Updates React Native test-project overrides for brace-expansion, js-yaml, and shell-quote.
test-projects/rn-purchasely-test/package-lock.json	Regenerates the React Native test-project dependency graph with compatible patched transitive versions.

_{Reviews (1): Last reviewed commit: "chore(deps): close brace-expansion / js-..." | Re-trigger Greptile}

[romainsalles]

Updated 2026-08-17 (commit ff2a144) to cover every critical/high Dependabot alert open since this PR was filed:

Root yarn.lock — tar → 7.5.22 (#731 CRITICAL, #730), nanoid → 3.3.18 (new resolution, #775/#774), brace-expansion → 1.1.18 (#772/#743/#726 — CVE-2026-14257 is now patched on the 1.x line, so the old "not fixable" note is obsolete), ip-address → 10.5.0 (#758), undici → 7.29.0 (#753), js-yaml 5.2.2 already covered (#739).

expo-purchasely-test — nanoid → 3.3.18 (new override, #776/#769), js-yaml → 4.3.1 (#767/#715), undici → 8.10.0 (#745), fast-uri → 4.1.2 (#744); tar 7.5.22 (#719 CRITICAL/#718), brace-expansion 5.0.8 (#765/#742/#714) and postcss 8.5.24 (#734) already at/above fix.

rn-purchasely-test — js-yaml → 4.3.1 (#771/#770/#723), shell-quote 1.10.0 already covered (#724).

Every flagged package verified at or above its fix version in all three lockfiles. Merging this makes Dependabot PRs #271–#277 redundant. build-ios remains red for the pre-existing, unrelated libRNScreens.a linker issue.

[macminisupport]

Dependabot PR review — 2026-08-18. (Posting here since Issues are disabled on this repo, and this PR is the natural hub for the decision below.)

7 Dependabot PRs are currently open, and — per this PR's own description — all 7 are very likely superseded by this one:

Supersedes Dependabot PRs — Merging this closes the alerts behind #271, #272, #273, #274, #275, #276, #277 (and earlier #269) — those can be closed.

#	Package	Version Change	Bump	CI	Action
#277	nanoid	3.3.11→3.3.18	patch	🟡 6/7 green, build-ios fails (matches the known linking issue noted in this PR's description)	Hold — superseded by this PR
#276	postcss (expo test project)	8.5.12→8.5.26	patch	🟡 same pattern	Hold — superseded by this PR
#275	nanoid (expo test project)	3.3.11→3.3.18	patch	🟡 same pattern	Hold — superseded by this PR
#274	undici	7.28.0→7.29.0	minor	🔴 all 7 checks fail, not just build-ios — different from the other 6, flagging separately	Hold — superseded by this PR, but worth its own look regardless
#273	undici (expo test project)	8.5.0→8.10.0	minor	🟡 same pattern	Hold — superseded by this PR
#272	fast-uri (expo test project)	4.1.1→4.1.2	patch	🟡 same pattern	Hold — superseded by this PR
#271	brace-expansion (expo test project)	1.1.14→1.1.18	patch	🟡 same pattern	Hold — superseded by this PR

No hold labels on any of the 7; nothing merged, closed, or commented on any of them this cycle pending your call.

#274 is the one exception worth a second look independent of this PR's fate — it fails lint and test too, which pass clean on the other 6. That's not the build-ios/libRNScreens linking issue this PR's description already explains; it may be a stale run or something specific to the root-package undici bump.

Waiting on an explicit go-ahead before touching any of #271–277: e.g. "close them once this merges" (matches this PR's own description), or "hold off, they're independent." No action taken on any of the 7 yet.

---

Generated by Claude Code

[macminisupport]

Dependabot PR review — 2026-08-19 cycle — fully unchanged, no merges/approvals/closures taken.

Re-verified all 7 Dependabot PRs via fresh get_check_runs, plus this PR's own state and comments. Everything matches the 2026-08-18 snapshot exactly — no new commits, no re-triggered CI, no new Dependabot PRs, and no new comments here or on any of #271–277 since yesterday's review.

#	Package	Version Change	Bump	CI	Action
#277	nanoid	3.3.11→3.3.18	patch	🟡 6/7 green, build-ios fails (pre-existing libRNScreens linking issue this PR's description already explains)	Hold — superseded by this PR
#276	postcss (expo test project)	8.5.12→8.5.26	patch	🟡 same pattern	Hold — superseded by this PR
#275	nanoid (expo test project)	3.3.11→3.3.18	patch	🟡 same pattern	Hold — superseded by this PR
#274	undici	7.28.0→7.29.0	minor	🔴 all 7 checks fail, still — not just build-ios	Hold — superseded by this PR, but still worth its own look independent of that
#273	undici (expo test project)	8.5.0→8.10.0	minor	🟡 same pattern	Hold — superseded by this PR
#272	fast-uri (expo test project)	4.1.1→4.1.2	patch	🟡 same pattern	Hold — superseded by this PR
#271	brace-expansion (expo test project)	1.1.14→1.1.18	patch	🟡 same pattern	Hold — superseded by this PR

No hold labels on any of the 7; nothing merged, closed, or commented on any of them this cycle.

This PR itself is unchanged since the 2026-08-17 update (mergeable_state: unstable — the pre-existing build-ios/libRNScreens linker failure, not a merge conflict). No human has responded to either the 2026-08-17 update or the 2026-08-18 review comment above.

Still waiting on an explicit go-ahead before touching #271–277: e.g. "close them once this merges" (matches this PR's own description), or "hold off, they're independent." No action taken on any of the 7 yet. #274's all-checks-red state is the one item worth a second look regardless of this PR's fate.

---

Generated by Claude Code

[macminisupport]

Heads up while reviewing open Dependabot PRs in this repo (note: GitHub Issues are disabled here, so posting this as a PR comment instead of a tracking issue):

This PR bumps nanoid, undici, fast-uri, and postcss — the same packages targeted by 6 currently-open Dependabot PRs: #277/#275 (nanoid), #274/#273 (undici), #272 (fast-uri), #276 (postcss). If this PR merges first, Dependabot should auto-close/supersede the overlapping ones — worth deciding this PR's fate before merging any of those individually to avoid duplicate or conflicting version bumps.

Separately, CI status on the individual Dependabot PRs: #276/#273/#272 are green and look like safe auto-merge candidates once this overlap is resolved. #277/#275 (nanoid) fail only on build-ios, which looks explained by the still-open #278 ("Swift header not found under Xcode 26 explicit modules") rather than the dependency bump itself. #274 (undici 7.28.0→7.29.0, root package) fails every CI job (not just iOS) as of a re-run on 2026-08-20 — that one looks like a real regression worth investigating separately from the toolchain issue.

No merge conflicts or hold labels on any of the 6. Not merging anything here without a maintainer's go-ahead.

---

Generated by Claude Code

[kherembourg]

Superseded by main. All 26 critical/high alerts this PR targets are now fixed on main (via 83e9413 "pin patched versions for 15 Dependabot alerts", 0602b36 qs, and #279–#282 for brace-expansion / js-yaml / shell-quote / tar). The repo has 0 open Dependabot alerts at any severity.

main resolves to tar 7.5.22, nanoid 3.3.18, brace-expansion 1.1.18, js-yaml 5.3.0, ip-address 10.7.0, undici 7.29.0, shell-quote 1.10.0 — at or above every target here. In the expo test project, tar / undici / fast-uri are gone from the lock tree entirely.

This branch's lockfiles are now older than main's (its rn-purchasely-test lock is ~691 lines behind), so a rebase would only regress them. Closing; nothing left to rebase. Branch deleted.