From 615c90400b4173ce9c3213e66e29f80816df5103 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Sat, 12 Sep 2026 10:39:09 -0400 Subject: [PATCH] fix(deps): raise xmldom override floor to clear remaining HIGH audit findings The workspace-root pnpm.overrides pin for @xmldom/xmldom was >=0.8.13, which stayed satisfied by 0.9.10 and left 11 HIGH GHSA advisories open (reachable via expo-local-authentication>expo>@expo/cli>@expo/plist). Raise the floor to >=0.9.12, the first patched release, so every resolution in the tree lands on a fixed version. No direct-dependency bump was viable here: the only path that drops xmldom without an override is jumping expo-local-authentication from its current SDK-51-era 14.0.1 to the latest 57.x line, which also forces expo-notifications and expo-secure-store to matching SDK releases -- a full native-module migration, not a dependency-audit fix. pnpm audit --audit-level=high now exits 0 (2 pre-existing ignored CVEs aside, unrelated and untouched). Verified with pnpm typecheck, pnpm build, and pnpm test --filter "@nself/*" -- all green. --- package.json | 2 +- pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index 3ecd3f1..6a5028f 100644 --- a/package.json +++ b/package.json @@ -33,7 +33,7 @@ "uuid": ">=11.1.1", "@opentelemetry/core": ">=2.8.0", "postcss": ">=8.5.18", - "@xmldom/xmldom": ">=0.8.13", + "@xmldom/xmldom": ">=0.9.12", "js-yaml": ">=4.3.1", "react": "19.0.0", "react-dom": "19.0.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index df22de2..e1a8488 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,7 +11,7 @@ overrides: uuid: '>=11.1.1' '@opentelemetry/core': '>=2.8.0' postcss: '>=8.5.18' - '@xmldom/xmldom': '>=0.8.13' + '@xmldom/xmldom': '>=0.9.12' js-yaml: '>=4.3.1' react: 19.0.0 react-dom: 19.0.0 @@ -2868,8 +2868,8 @@ packages: resolution: {integrity: sha512-Nst5JdK47VIl9UcGwtv2Rcgyn5lWtZ0/mhRQ4G8NN2isxpq2TO30iqHzmwoJycjWuyUfg3GFXqP/gFHXeV57IA==} engines: {node: '>=16.0.0'} - '@xmldom/xmldom@0.9.10': - resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} + '@xmldom/xmldom@0.9.12': + resolution: {integrity: sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==} engines: {node: '>=14.6'} abbrev@1.1.1: @@ -7623,20 +7623,20 @@ snapshots: '@expo/plist@0.2.2': dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 base64-js: 1.5.1 xmlbuilder: 14.0.0 '@expo/plist@0.3.5': dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 base64-js: 1.5.1 xmlbuilder: 15.1.1 optional: true '@expo/plist@0.7.0': dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 base64-js: 1.5.1 xmlbuilder: 15.1.1 @@ -9730,7 +9730,7 @@ snapshots: dependencies: tslib: 2.8.1 - '@xmldom/xmldom@0.9.10': {} + '@xmldom/xmldom@0.9.12': {} abbrev@1.1.1: {} @@ -12376,7 +12376,7 @@ snapshots: plist@3.1.1: dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 base64-js: 1.5.1 xmlbuilder: 15.1.1