From f7d5f0b74f42673f05cc0ef31629d3724ec62496 Mon Sep 17 00:00:00 2001 From: MP2EZ <182439403+MP2EZ@users.noreply.github.com> Date: Tue, 8 Sep 2026 17:32:49 -0700 Subject: [PATCH 1/2] chore(release): v1.3.0 version bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump version across all four INFRA-141 sources: - app/package.json - app/app.json (Expo manifest + iOS buildNumber + Android versionCode) - .config/.env.production (untracked, edited in place) - .config/.env.development (untracked, edited in place) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01CkZagJp7dzojvrjY7uYwkh --- app/app.json | 6 +++--- app/package-lock.json | 4 ++-- app/package.json | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/app/app.json b/app/app.json index 0427fa35..4413c7db 100644 --- a/app/app.json +++ b/app/app.json @@ -2,7 +2,7 @@ "expo": { "name": "Being", "slug": "being", - "version": "1.2.1", + "version": "1.3.0", "orientation": "portrait", "icon": "./assets/icon.png", "userInterfaceStyle": "automatic", @@ -15,7 +15,7 @@ "ios": { "supportsTablet": true, "bundleIdentifier": "fyi.being.app", - "buildNumber": "5", + "buildNumber": "6", "icon": "./assets/icon.png", "deploymentTarget": "16.4", "config": { @@ -61,7 +61,7 @@ }, "android": { "package": "fyi.being.app", - "versionCode": 5, + "versionCode": 6, "icon": "./assets/icon.png", "intentFilters": [ { diff --git a/app/package-lock.json b/app/package-lock.json index aa693a25..3b7b9fc3 100644 --- a/app/package-lock.json +++ b/app/package-lock.json @@ -1,12 +1,12 @@ { "name": "app", - "version": "1.2.1", + "version": "1.3.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "app", - "version": "1.2.1", + "version": "1.3.0", "hasInstallScript": true, "dependencies": { "@mp2ez/being-design-system": "^1.10.0", diff --git a/app/package.json b/app/package.json index 55cd5868..5f9ad098 100644 --- a/app/package.json +++ b/app/package.json @@ -1,6 +1,6 @@ { "name": "app", - "version": "1.2.1", + "version": "1.3.0", "main": "index.ts", "engines": { "node": ">=24.3.0" From c0594191aaeae8565f48a2b2c68dff418604004f Mon Sep 17 00:00:00 2001 From: MP2EZ <182439403+MP2EZ@users.noreply.github.com> Date: Tue, 8 Sep 2026 17:39:09 -0700 Subject: [PATCH 2/2] chore: bump js-yaml overrides past GHSA-2883-xcg3-v3hh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A new HIGH advisory (CVSS 7.5, CWE-400 ReDoS-class: maxTotalMergeKeys does not limit CPU use for empty merge sources) published against js-yaml >=3.0.0 <3.15.2 and >=4.0.0 <4.3.2. It landed after development's last green run and fails `Security + compliance` on every open PR, including this release's bump PR — the gate is severity-based and this is un-allowlisted. Targeted fix per the standing npm-audit rule, never `npm audit fix`: the existing pins were already at 3.15.1 / 4.3.1, so the fixed releases are in-range patch bumps of the same pins. Bumped all three keys in `overrides` and mirrored them in `resolutions`: js-yaml@^3.13.1 3.15.1 -> 3.15.2 js-yaml@^4.1.0 4.3.1 -> 4.3.2 js-yaml@^4.1.1 4.3.1 -> 4.3.2 Not allowlisted, because a real fix exists and the consumers tolerate it — all three are build-time only (@react-native/jest-preset -> babel-jest -> babel-plugin-istanbul, eslint -> @eslint/eslintrc, and expo -> @expo/cli -> @expo/xcpretty). Nothing here reaches the app bundle. Lockfile movement is confined to js-yaml and the argparse it pulls: the 3.x nested copy bumps in place, and the two nested 4.3.1 copies dedupe into one hoisted 4.3.2. No expo or react-native package moved, so this carries no native-surface change (Phase 2.8 clean). Verified: `npx audit-ci --config .audit-ci.json` -> "Passed npm security audit", exit 0 (high 8 -> 7, the remaining 7 all allowlisted); `npx patch-package` -> expo-modules-jsi@56.0.12 ✔. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01CkZagJp7dzojvrjY7uYwkh --- app/package-lock.json | 92 +++++++++++++++---------------------------- app/package.json | 12 +++--- 2 files changed, 37 insertions(+), 67 deletions(-) diff --git a/app/package-lock.json b/app/package-lock.json index 3b7b9fc3..4c3177cb 100644 --- a/app/package-lock.json +++ b/app/package-lock.json @@ -1500,13 +1500,6 @@ "url": "https://opencollective.com/eslint" } }, - "node_modules/@eslint/eslintrc/node_modules/argparse": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", - "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", - "dev": true, - "license": "Python-2.0" - }, "node_modules/@eslint/eslintrc/node_modules/balanced-match": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", @@ -1535,29 +1528,6 @@ "node": ">= 4" } }, - "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/@eslint/eslintrc/node_modules/minimatch": { "version": "3.1.5", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", @@ -2085,34 +2055,6 @@ "excpretty": "build/cli.js" } }, - "node_modules/@expo/xcpretty/node_modules/argparse": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", - "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", - "license": "Python-2.0" - }, - "node_modules/@expo/xcpretty/node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/@humanfs/core": { "version": "0.19.2", "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz", @@ -2220,9 +2162,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "devOptional": true, "license": "MIT", "dependencies": { @@ -9393,6 +9335,34 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==", "license": "MIT" }, + "node_modules/js-yaml": { + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, + "node_modules/js-yaml/node_modules/argparse": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", + "license": "Python-2.0" + }, "node_modules/jsc-safe-url": { "version": "0.2.4", "resolved": "https://registry.npmjs.org/jsc-safe-url/-/jsc-safe-url-0.2.4.tgz", diff --git a/app/package.json b/app/package.json index 5f9ad098..43fe2395 100644 --- a/app/package.json +++ b/app/package.json @@ -134,9 +134,9 @@ "brace-expansion@^1.1.7": "1.1.18", "brace-expansion@^5.0.5": "5.0.9", "postcss": "^8.5.18", - "js-yaml@^3.13.1": "3.15.1", - "js-yaml@^4.1.0": "4.3.1", - "js-yaml@^4.1.1": "4.3.1", + "js-yaml@^3.13.1": "3.15.2", + "js-yaml@^4.1.0": "4.3.2", + "js-yaml@^4.1.1": "4.3.2", "nanoid@^3.3.11": "3.3.18", "nanoid@^3.3.16": "3.3.18", "browserslist": "^4.28.7", @@ -151,9 +151,9 @@ "brace-expansion@^1.1.7": "1.1.18", "brace-expansion@^5.0.5": "5.0.9", "postcss": "^8.5.18", - "js-yaml@^3.13.1": "3.15.1", - "js-yaml@^4.1.0": "4.3.1", - "js-yaml@^4.1.1": "4.3.1", + "js-yaml@^3.13.1": "3.15.2", + "js-yaml@^4.1.0": "4.3.2", + "js-yaml@^4.1.1": "4.3.2", "nanoid@^3.3.11": "3.3.18", "nanoid@^3.3.16": "3.3.18", "browserslist": "^4.28.7",