From 07305c5bae4699b8cac4cc41d002db78dcc49231 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Mon, 31 Aug 2026 20:23:12 -0400 Subject: [PATCH 1/2] fix(deps): override decode-uri-component to 0.5.0 for GHSA-vcc3-ghjq-m6fr The advisory was published after main last passed its dependency audit, so it started failing every open PR without any of them changing a dependency. Severity 6.6, and upstream has a fix, so this is an override rather than a filter entry. Follows the existing convention in the root overrides block. Verified by the resolved version in the lockfile rather than by the config alone: the lockfile now contains only decode-uri-component@0.5.0, with no remaining 0.x below 0.5.0. Overrides declared anywhere other than the workspace root are silently ignored, so checking the config would not have proved anything. --- package.json | 3 ++- pnpm-lock.yaml | 14 ++++++-------- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index acd7bae..f9a7720 100644 --- a/package.json +++ b/package.json @@ -40,7 +40,8 @@ "minimatch@>=10.0.0 <10.2.3": "^10.2.3", "path-to-regexp@>=6.0.0 <6.3.0": "^6.3.0", "smol-toml@>=1.0.0 <1.6.1": "^1.6.1", - "@tootallnate/once@>=2.0.0 <2.0.1": "^2.0.1" + "@tootallnate/once@>=2.0.0 <2.0.1": "^2.0.1", + "decode-uri-component@<0.5.0": "^0.5.0" }, "patchedDependencies": { "@expo/plist@0.2.2": "patches/@expo__plist@0.2.2.patch", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d4e983a..03c356f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -40,6 +40,7 @@ overrides: path-to-regexp@>=6.0.0 <6.3.0: ^6.3.0 smol-toml@>=1.0.0 <1.6.1: ^1.6.1 '@tootallnate/once@>=2.0.0 <2.0.1': ^2.0.1 + decode-uri-component@<0.5.0: ^0.5.0 patchedDependencies: '@expo/plist@0.2.2': @@ -675,9 +676,6 @@ importers: fake-indexeddb: specifier: ^6.0.0 version: 6.2.5 - jsdom: - specifier: ^29.1.1 - version: 29.1.1 vitest: specifier: ^3.2.6 version: 3.2.6(@edge-runtime/vm@3.2.0)(@types/node@25.9.5)(jiti@2.7.0)(jsdom@29.1.1)(lightningcss@1.32.0)(msw@2.14.6(@types/node@25.9.5)(typescript@6.0.3))(terser@5.48.0)(tsx@4.22.4)(yaml@2.9.0) @@ -4929,9 +4927,9 @@ packages: decimal.js@10.6.0: resolution: {integrity: sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==} - decode-uri-component@0.2.2: - resolution: {integrity: sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==} - engines: {node: '>=0.10'} + decode-uri-component@0.5.0: + resolution: {integrity: sha512-1BiQVoK8C9gUbQU6NzAtO/tkz2qOFpEObMWpcFvhx4fYnj4Oc5yzaJN/LD36ihkVUdXyh5ZekzX+yM+ty/SrPg==} + engines: {node: '>=14.16'} dedent@1.7.2: resolution: {integrity: sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==} @@ -13951,7 +13949,7 @@ snapshots: decimal.js@10.6.0: {} - decode-uri-component@0.2.2: {} + decode-uri-component@0.5.0: {} dedent@1.7.2: {} @@ -17218,7 +17216,7 @@ snapshots: query-string@7.1.3: dependencies: - decode-uri-component: 0.2.2 + decode-uri-component: 0.5.0 filter-obj: 1.1.0 split-on-first: 1.1.0 strict-uri-encode: 2.0.0 From 3c673e3ecff46aff5b0298e9e63b8dce594b8d17 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Mon, 31 Aug 2026 20:26:20 -0400 Subject: [PATCH 2/2] fix(deps): sync the lockfile with the shared packages clone The lockfile was stale against packages/@nself/offline-queue, which declared jsdom after this repo last resolved. CI clones the shared packages fresh, so it saw the declaration and refused the frozen install with ERR_PNPM_OUTDATED_LOCKFILE, while a local clone that was five commits behind resolved without it. That is the failure mode of cloning another repo into this one: the lockfile depends on the state of a checkout that nothing here pins. The local clone has been fast-forwarded and the lockfile regenerated against it. Verified with the command CI actually runs, pnpm install --frozen-lockfile, which now exits 0. --- pnpm-lock.yaml | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 03c356f..1ef0484 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -230,7 +230,7 @@ importers: version: 5.4.3(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@testing-library/react-native': specifier: ^12.5.0 - version: 12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) + version: 12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@types/jest': specifier: ^29.5.12 version: 29.5.14 @@ -251,10 +251,10 @@ importers: version: 8.57.1 jest: specifier: ^29.7.0 - version: 29.7.0(@types/node@22.19.21) + version: 29.7.0(@types/node@25.9.5) jest-expo: specifier: ~53.0.0 - version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0) + version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0) typescript: specifier: ^5.3.3 version: 5.9.3 @@ -348,7 +348,7 @@ importers: version: 5.4.3(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@testing-library/react-native': specifier: ^12.5.0 - version: 12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) + version: 12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@types/jest': specifier: ^29.5.12 version: 29.5.14 @@ -366,10 +366,10 @@ importers: version: 8.57.1 jest: specifier: ^29.7.0 - version: 29.7.0(@types/node@25.9.5) + version: 29.7.0(@types/node@22.19.21) jest-expo: specifier: ~53.0.0 - version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react@19.0.0) + version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react@19.0.0) typescript: specifier: ^5.3.3 version: 5.9.3 @@ -676,6 +676,9 @@ importers: fake-indexeddb: specifier: ^6.0.0 version: 6.2.5 + jsdom: + specifier: ^29.1.1 + version: 29.1.1 vitest: specifier: ^3.2.6 version: 3.2.6(@edge-runtime/vm@3.2.0)(@types/node@25.9.5)(jiti@2.7.0)(jsdom@29.1.1)(lightningcss@1.32.0)(msw@2.14.6(@types/node@25.9.5)(typescript@6.0.3))(terser@5.48.0)(tsx@4.22.4)(yaml@2.9.0) @@ -9641,7 +9644,7 @@ snapshots: '@babel/helper-module-imports': 7.29.7 '@babel/helper-plugin-utils': 7.29.7 '@babel/plugin-syntax-jsx': 7.29.7(@babel/core@7.29.7) - '@babel/types': 7.29.7 + '@babel/types': 7.29.8 transitivePeerDependencies: - supports-color @@ -12439,23 +12442,23 @@ snapshots: react-test-renderer: 19.0.0(react@19.0.0) redent: 3.0.0 - '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': + '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': dependencies: jest-matcher-utils: 29.7.0 pretty-format: 29.7.0 react: 19.0.0 - react-native: 0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0) + react-native: react-native-tvos@0.79.2-0(@babel/core@7.29.7)(@types/react@19.0.14)(react-native-tvos@0.79.2-0)(react@19.0.0) react-test-renderer: 19.0.0(react@19.0.0) redent: 3.0.0 optionalDependencies: jest: 29.7.0(@types/node@22.19.21) - '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': + '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': dependencies: jest-matcher-utils: 29.7.0 pretty-format: 29.7.0 react: 19.0.0 - react-native: react-native-tvos@0.79.2-0(@babel/core@7.29.7)(@types/react@19.0.14)(react-native-tvos@0.79.2-0)(react@19.0.0) + react-native: 0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0) react-test-renderer: 19.0.0(react@19.0.0) redent: 3.0.0 optionalDependencies: @@ -15746,7 +15749,7 @@ snapshots: jest-mock: 29.7.0 jest-util: 29.7.0 - jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react@19.0.0): + jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react@19.0.0): dependencies: '@expo/config': 11.0.13 '@expo/json-file': 9.1.5 @@ -15758,7 +15761,7 @@ snapshots: jest-environment-jsdom: 29.7.0 jest-snapshot: 29.7.0 jest-watch-select-projects: 2.0.0 - jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@25.9.5)) + jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@22.19.21)) json5: 2.2.3 lodash: 4.18.1 react-native: react-native-tvos@0.79.2-0(@babel/core@7.29.7)(@types/react@19.0.14)(react-native-tvos@0.79.2-0)(react@19.0.0) @@ -15774,7 +15777,7 @@ snapshots: - supports-color - utf-8-validate - jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0): + jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0): dependencies: '@expo/config': 11.0.13 '@expo/json-file': 9.1.5 @@ -15786,7 +15789,7 @@ snapshots: jest-environment-jsdom: 29.7.0 jest-snapshot: 29.7.0 jest-watch-select-projects: 2.0.0 - jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@22.19.21)) + jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@25.9.5)) json5: 2.2.3 lodash: 4.18.1 react-native: 0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0)