chore(release): v1.3.0 version bump + unblock the npm-audit gate - #479
Merged
Conversation
Bump version across all four INFRA-141 sources: - app/package.json - app/app.json (Expo manifest + iOS buildNumber + Android versionCode) - .config/.env.production (untracked, edited in place) - .config/.env.development (untracked, edited in place) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkZagJp7dzojvrjY7uYwkh
A new HIGH advisory (CVSS 7.5, CWE-400 ReDoS-class: maxTotalMergeKeys does not limit CPU use for empty merge sources) published against js-yaml >=3.0.0 <3.15.2 and >=4.0.0 <4.3.2. It landed after development's last green run and fails `Security + compliance` on every open PR, including this release's bump PR — the gate is severity-based and this is un-allowlisted. Targeted fix per the standing npm-audit rule, never `npm audit fix`: the existing pins were already at 3.15.1 / 4.3.1, so the fixed releases are in-range patch bumps of the same pins. Bumped all three keys in `overrides` and mirrored them in `resolutions`: js-yaml@^3.13.1 3.15.1 -> 3.15.2 js-yaml@^4.1.0 4.3.1 -> 4.3.2 js-yaml@^4.1.1 4.3.1 -> 4.3.2 Not allowlisted, because a real fix exists and the consumers tolerate it — all three are build-time only (@react-native/jest-preset -> babel-jest -> babel-plugin-istanbul, eslint -> @eslint/eslintrc, and expo -> @expo/cli -> @expo/xcpretty). Nothing here reaches the app bundle. Lockfile movement is confined to js-yaml and the argparse it pulls: the 3.x nested copy bumps in place, and the two nested 4.3.1 copies dedupe into one hoisted 4.3.2. No expo or react-native package moved, so this carries no native-surface change (Phase 2.8 clean). Verified: `npx audit-ci --config .audit-ci.json` -> "Passed npm security audit", exit 0 (high 8 -> 7, the remaining 7 all allowlisted); `npx patch-package` -> expo-modules-jsi@56.0.12 ✔. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CkZagJp7dzojvrjY7uYwkh
MP2EZ
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits, both required to cut v1.3.0.
1.
chore(release): v1.3.0 version bump— bumps all four INFRA-141 version sources from v1.2.1 → v1.3.0 (build 5 → 6). Six lines: version and build only.2.
chore: bump js-yaml overrides past GHSA-2883-xcg3-v3hh— a new HIGH advisory (CVSS 7.5) published againstjs-yaml <3.15.2 / <4.3.2after development's last green run. It is un-allowlisted and severity-gated, so it failsSecurity + complianceon every open PR, not just this one. Fixed by bumping the three existingoverridespins to the fixed patch releases and mirroring them inresolutions— nevernpm audit fix. All three consumers are build-time only (jest-preset, eslint, @expo/xcpretty); nothing reaches the app bundle. Lockfile movement is confined to js-yaml and itsargparse; no expo/react-native package moved.Verified locally:
npx audit-ci --config .audit-ci.json→ "Passed npm security audit", exit 0.npx patch-package→expo-modules-jsi@56.0.12 ✔.After this merges, the dev → main release PR opens.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CkZagJp7dzojvrjY7uYwkh