From d4761d75d84a5d126a0d8306576900fce8048dac Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Tue, 1 Sep 2026 18:04:18 -0400 Subject: [PATCH] fix(deps): override browserslist to 4.28.7+ for GHSA-c83g-rgw3-j3cx Two newly published HIGH advisories against browserslist <= 4.28.6 (unbounded memory growth from an unevicted query-result cache, plus a crash/prototype-write via untrusted browserslist-stats.json), patched in 4.28.7. Reached transitively via babel, so no direct dependency to bump. Overridden at the workspace root (apps/mobile is a workspace member, so its pnpm.overrides field has no effect there per pnpm's own warning -- added anyway for documentation/defense since apps/mobile also ships a standalone-looking package.json, but the root override is what actually governs). The nested packages/ clone (gitignored, cloned fresh at install time per CI) was refreshed from nself-org/packages main before regenerating, picking up its eslint/typescript-eslint devDependency addition to @nself/tailwind-brand as a side effect. Verified by the resolved lockfile version rather than the config: browserslist now resolves to 4.28.8. CI=true pnpm install --frozen-lockfile exits 0 at the workspace root. pnpm audit --audit-level=high still exits non-zero (2 pre-existing HIGH findings via metro>image-size, unrelated to this advisory). Discovery (not fixed here, out of scope): apps/mobile/pnpm-lock.yaml appears to be a dead file -- running pnpm install from within apps/mobile still resolves against the root pnpm-workspace.yaml (pnpm walks up to find it) and never touches apps/mobile's own lockfile, so the CI step that installs there is actually exercising the root lockfile already fixed by this change. --- apps/mobile/package.json | 3 +- package.json | 3 +- pnpm-lock.yaml | 102 +++++++++++++++++++++++---------------- 3 files changed, 65 insertions(+), 43 deletions(-) diff --git a/apps/mobile/package.json b/apps/mobile/package.json index 2bcab20..94ec1c1 100644 --- a/apps/mobile/package.json +++ b/apps/mobile/package.json @@ -68,7 +68,8 @@ "overrides": { "form-data@<3.0.5": "^3.0.5", "form-data@>=4.0.0 <4.0.6": "^4.0.6", - "js-yaml@<4.2.0": "^4.2.0" + "js-yaml@<4.2.0": "^4.2.0", + "browserslist@<4.28.7": "^4.28.7" } } } diff --git a/package.json b/package.json index 21ec622..9ba3b56 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,8 @@ "path-to-regexp@>=6.0.0 <6.3.0": "^6.3.0", "smol-toml@>=1.0.0 <1.6.1": "^1.6.1", "@tootallnate/once@>=2.0.0 <2.0.1": "^2.0.1", - "decode-uri-component@<0.5.0": "^0.5.0" + "decode-uri-component@<0.5.0": "^0.5.0", + "browserslist@<4.28.7": "^4.28.7" }, "patchedDependencies": { "@expo/plist@0.2.2": "patches/@expo__plist@0.2.2.patch", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1ef0484..81726db 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -41,6 +41,7 @@ overrides: smol-toml@>=1.0.0 <1.6.1: ^1.6.1 '@tootallnate/once@>=2.0.0 <2.0.1': ^2.0.1 decode-uri-component@<0.5.0: ^0.5.0 + browserslist@<4.28.7: ^4.28.7 patchedDependencies: '@expo/plist@0.2.2': @@ -230,7 +231,7 @@ importers: version: 5.4.3(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@testing-library/react-native': specifier: ^12.5.0 - version: 12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) + version: 12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@types/jest': specifier: ^29.5.12 version: 29.5.14 @@ -251,10 +252,10 @@ importers: version: 8.57.1 jest: specifier: ^29.7.0 - version: 29.7.0(@types/node@25.9.5) + version: 29.7.0(@types/node@22.19.21) jest-expo: specifier: ~53.0.0 - version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0) + version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0) typescript: specifier: ^5.3.3 version: 5.9.3 @@ -348,7 +349,7 @@ importers: version: 5.4.3(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@testing-library/react-native': specifier: ^12.5.0 - version: 12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) + version: 12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0) '@types/jest': specifier: ^29.5.12 version: 29.5.14 @@ -366,10 +367,10 @@ importers: version: 8.57.1 jest: specifier: ^29.7.0 - version: 29.7.0(@types/node@22.19.21) + version: 29.7.0(@types/node@25.9.5) jest-expo: specifier: ~53.0.0 - version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react@19.0.0) + version: 53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react@19.0.0) typescript: specifier: ^5.3.3 version: 5.9.3 @@ -379,12 +380,18 @@ importers: '@types/node': specifier: ^25.8.0 version: 25.9.5 + eslint: + specifier: ^9.32.0 + version: 9.39.5(jiti@2.7.0) tsup: specifier: ^8.5.1 version: 8.5.1(jiti@2.7.0)(postcss@8.5.26)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0) typescript: specifier: ^6.0.3 version: 6.0.3 + typescript-eslint: + specifier: ^8 + version: 8.67.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3) vitest: specifier: ^3.2.6 version: 3.2.6(@edge-runtime/vm@3.2.0)(@types/node@25.9.5)(jiti@2.7.0)(jsdom@29.1.1)(lightningcss@1.32.0)(msw@2.14.6(@types/node@25.9.5)(typescript@6.0.3))(terser@5.48.0)(tsx@4.22.4)(yaml@2.9.0) @@ -398,6 +405,9 @@ importers: '@types/react': specifier: ^19.0.0 version: 19.0.14 + eslint: + specifier: ^9.32.0 + version: 9.39.5(jiti@2.7.0) react: specifier: 19.0.0 version: 19.0.0 @@ -407,6 +417,9 @@ importers: typescript: specifier: ^6.0.3 version: 6.0.3 + typescript-eslint: + specifier: ^8 + version: 8.67.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3) vitest: specifier: ^3.2.6 version: 3.2.6(@edge-runtime/vm@3.2.0)(@types/node@25.9.5)(jiti@2.7.0)(jsdom@29.1.1)(lightningcss@1.32.0)(msw@2.14.6(@types/node@25.9.5)(typescript@6.0.3))(terser@5.48.0)(tsx@4.22.4)(yaml@2.9.0) @@ -721,9 +734,15 @@ importers: specifier: '>=3.0.0 || >=4.0.0' version: 4.3.3 devDependencies: + eslint: + specifier: ^9.32.0 + version: 9.39.5(jiti@2.7.0) typescript: specifier: ^6.0.3 version: 6.0.3 + typescript-eslint: + specifier: ^8 + version: 8.67.0(eslint@9.39.5(jiti@2.7.0))(typescript@6.0.3) vitest: specifier: ^3.2.6 version: 3.2.6(@edge-runtime/vm@3.2.0)(@types/node@25.9.5)(jiti@2.7.0)(jsdom@29.1.1)(lightningcss@1.32.0)(msw@2.14.6(@types/node@25.9.5)(typescript@6.0.3))(terser@5.48.0)(tsx@4.22.4)(yaml@2.9.0) @@ -4436,8 +4455,8 @@ packages: base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} - baseline-browser-mapping@2.10.37: - resolution: {integrity: sha512-girxaJ7WZssDOFhzCGZTDKoTa1gk6A1TbflaYTpykLJ4UU9Fz9kx1aREM8JCuoVHbL8X8T/mJg7w2oYSq72Oig==} + baseline-browser-mapping@2.11.20: + resolution: {integrity: sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==} engines: {node: '>=6.0.0'} hasBin: true @@ -4487,8 +4506,8 @@ packages: browser-assert@1.2.1: resolution: {integrity: sha512-nfulgvOR6S4gt9UKCeGJOuSGBPGiFT6oQ/2UBnvTY/5aQ1PnksW72fhZkM30DzoRRv2WpwZf1vHHEr3mtuXIWQ==} - browserslist@4.28.2: - resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==} + browserslist@4.28.8: + resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -4558,8 +4577,8 @@ packages: camelize@1.0.1: resolution: {integrity: sha512-dU+Tx2fsypxTgtLoE36npi3UqcjSSMNYfkqgmoEhtZrraP5VWq0K7FkWVTYa8eMPtnU/G2txVsfdCJTn9uzpuQ==} - caniuse-lite@1.0.30001799: - resolution: {integrity: sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==} + caniuse-lite@1.0.30001810: + resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} chai@5.3.3: resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==} @@ -5067,8 +5086,8 @@ packages: engines: {node: '>=0.10.0'} hasBin: true - electron-to-chromium@1.5.374: - resolution: {integrity: sha512-HCF5i7izveksHSGqa7mhDh6tr3Uz9Dar2RAjwuh69bw3QGPVObjQIgLwQWeO/Rxp9/r0KdboKy9RbpQDl97fjg==} + electron-to-chromium@1.5.419: + resolution: {integrity: sha512-nHMPn8x4yCxCI0iSnL+LlHL5sUoUfjLXkcRIagZ4GBdrfFLFaiLNvzJWbJqZhFT9IAhw5tUSNlhggWN+otvp/A==} emittery@0.13.1: resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==} @@ -5224,6 +5243,7 @@ packages: eslint@9.39.5: resolution: {integrity: sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} + deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options. hasBin: true peerDependencies: jiti: '*' @@ -7005,8 +7025,8 @@ packages: node-int64@0.4.0: resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==} - node-releases@2.0.47: - resolution: {integrity: sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==} + node-releases@2.0.54: + resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==} engines: {node: '>=18'} nopt@8.1.0: @@ -8467,11 +8487,11 @@ packages: resolution: {integrity: sha512-aZwGpamFO61g3OlfT7OQCHqhGnW43ieH9WZeP7QxN/G/jS4jfqUkZxoryvJgVPEcrl5NL/ggHsSmLMHuH64Lhg==} engines: {node: '>=4'} - update-browserslist-db@1.2.3: - resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} + update-browserslist-db@1.3.2: + resolution: {integrity: sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: ^4.28.7 uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} @@ -9041,7 +9061,7 @@ snapshots: dependencies: '@babel/compat-data': 7.29.7 '@babel/helper-validator-option': 7.29.7 - browserslist: 4.28.2 + browserslist: 4.28.8 lru-cache: 5.1.1 semver: 6.3.1 @@ -12442,23 +12462,23 @@ snapshots: react-test-renderer: 19.0.0(react@19.0.0) redent: 3.0.0 - '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': + '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': dependencies: jest-matcher-utils: 29.7.0 pretty-format: 29.7.0 react: 19.0.0 - react-native: react-native-tvos@0.79.2-0(@babel/core@7.29.7)(@types/react@19.0.14)(react-native-tvos@0.79.2-0)(react@19.0.0) + react-native: 0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0) react-test-renderer: 19.0.0(react@19.0.0) redent: 3.0.0 optionalDependencies: jest: 29.7.0(@types/node@22.19.21) - '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': + '@testing-library/react-native@12.9.0(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react-test-renderer@19.0.0(react@19.0.0))(react@19.0.0)': dependencies: jest-matcher-utils: 29.7.0 pretty-format: 29.7.0 react: 19.0.0 - react-native: 0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0) + react-native: react-native-tvos@0.79.2-0(@babel/core@7.29.7)(@types/react@19.0.14)(react-native-tvos@0.79.2-0)(react@19.0.0) react-test-renderer: 19.0.0(react@19.0.0) redent: 3.0.0 optionalDependencies: @@ -13448,7 +13468,7 @@ snapshots: base64-js@1.5.1: {} - baseline-browser-mapping@2.10.37: {} + baseline-browser-mapping@2.11.20: {} better-opn@3.0.2: dependencies: @@ -13509,13 +13529,13 @@ snapshots: browser-assert@1.2.1: {} - browserslist@4.28.2: + browserslist@4.28.8: dependencies: - baseline-browser-mapping: 2.10.37 - caniuse-lite: 1.0.30001799 - electron-to-chromium: 1.5.374 - node-releases: 2.0.47 - update-browserslist-db: 1.2.3(browserslist@4.28.2) + baseline-browser-mapping: 2.11.20 + caniuse-lite: 1.0.30001810 + electron-to-chromium: 1.5.419 + node-releases: 2.0.54 + update-browserslist-db: 1.3.2(browserslist@4.28.8) bser@2.1.1: dependencies: @@ -13574,7 +13594,7 @@ snapshots: camelize@1.0.1: {} - caniuse-lite@1.0.30001799: {} + caniuse-lite@1.0.30001810: {} chai@5.3.3: dependencies: @@ -13779,7 +13799,7 @@ snapshots: core-js-compat@3.49.0: dependencies: - browserslist: 4.28.2 + browserslist: 4.28.8 cors@2.8.6: dependencies: @@ -14075,7 +14095,7 @@ snapshots: dependencies: jake: 10.9.4 - electron-to-chromium@1.5.374: {} + electron-to-chromium@1.5.419: {} emittery@0.13.1: {} @@ -15749,7 +15769,7 @@ snapshots: jest-mock: 29.7.0 jest-util: 29.7.0 - jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native-tvos@0.79.2-0)(react@19.0.0): + jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native-tvos@0.79.2-0)(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native-tvos@0.79.2-0)(react@19.0.0): dependencies: '@expo/config': 11.0.13 '@expo/json-file': 9.1.5 @@ -15761,7 +15781,7 @@ snapshots: jest-environment-jsdom: 29.7.0 jest-snapshot: 29.7.0 jest-watch-select-projects: 2.0.0 - jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@22.19.21)) + jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@25.9.5)) json5: 2.2.3 lodash: 4.18.1 react-native: react-native-tvos@0.79.2-0(@babel/core@7.29.7)(@types/react@19.0.14)(react-native-tvos@0.79.2-0)(react@19.0.0) @@ -15777,7 +15797,7 @@ snapshots: - supports-color - utf-8-validate - jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@25.9.5))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0): + jest-expo@53.0.14(@babel/core@7.29.7)(expo@53.0.27(@babel/core@7.29.7)(graphql@16.14.2)(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0))(jest@29.7.0(@types/node@22.19.21))(react-native@0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0))(react@19.0.0): dependencies: '@expo/config': 11.0.13 '@expo/json-file': 9.1.5 @@ -15789,7 +15809,7 @@ snapshots: jest-environment-jsdom: 29.7.0 jest-snapshot: 29.7.0 jest-watch-select-projects: 2.0.0 - jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@25.9.5)) + jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@22.19.21)) json5: 2.2.3 lodash: 4.18.1 react-native: 0.79.7(@babel/core@7.29.7)(@types/react@19.0.14)(react@19.0.0) @@ -16880,7 +16900,7 @@ snapshots: node-int64@0.4.0: {} - node-releases@2.0.47: {} + node-releases@2.0.54: {} nopt@8.1.0: dependencies: @@ -18483,9 +18503,9 @@ snapshots: upath@1.2.0: {} - update-browserslist-db@1.2.3(browserslist@4.28.2): + update-browserslist-db@1.3.2(browserslist@4.28.8): dependencies: - browserslist: 4.28.2 + browserslist: 4.28.8 escalade: 3.2.0 picocolors: 1.1.1