fix(deps): resolve all fixable pnpm audit advisories

[mattinannt]

Summary

pnpm audit on main reported 56 advisories (1 critical, 40 high, 14 moderate, 1 low). All of them were in transitive dev/tooling dependencies — nothing in the published SDK's runtime dependencies (@react-native-community/netinfo, zod).

After this change: 0 fixable advisories remain (see the one caveat below).

	before	after
critical	1	0
high	40	2 (no upstream fix)
moderate	14	0
low	1	0

Changes

Direct dependency bump (packages/react-native/package.json)

• vitest and @vitest/coverage-v8 4.1.2 → 4.1.11 — fixes GHSA-82fw-gwwq-j7x9 (path traversal / arbitrary file read via @vitest/mocker redirect mock).

New pnpm.overrides entries (root package.json) — everything else is transitive through expo, react-native, metro, rimraf and vite, so overrides are the only lever. All pins are exact, as scripts/check-exact-deps.mjs requires. Where a package appears in two major lines, both are pinned with a range selector.

package	from	to	advisories fixed
@xmldom/xmldom	0.9.10	0.9.12	11 (injection, ReDoS, quadratic parse/serialize)
shell-quote	1.8.3	1.10.0	GHSA-w7jw-789q-3m8p (critical, command injection via unescaped newlines), GHSA-395f-4hp3-45gv
postcss	8.4.49 / 8.5.16	8.5.28	GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93
js-yaml	3.14.2 / 4.1.1	3.15.2 / 4.3.2	GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68
brace-expansion	1.1.13 / 5.0.5	1.1.18 / 5.0.9	GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, GHSA-3jxr-9vmj-r5cp, GHSA-jxxr-4gwj-5jf2
ws	7.5.10 / 8.19.0	7.5.13 / 8.21.3	GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx
nanoid	3.3.11 / 3.3.15	3.3.19	GHSA-2v37-7h3g-55p8, GHSA-28wg-ghj8-5hjv, GHSA-xwg4-73v4-xw9w
browserslist	4.28.1 / 4.28.4	4.28.9	GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g
baseline-browser-mapping	2.9.19 / 2.10.40	2.11.23	GHSA-w5vr-8v7q-w6rv
uuid	7.0.3	11.1.1	GHSA-w5hq-g745-h8pq

Two notes on the resolution:

• uuid 7 → 11 is a major bump. Its only consumer is xcode (via @expo/config-plugins), which uses exactly one API, uuid.v4() — still a named CJS export in v11. Verified it resolves and returns a valid v4 UUID under the override.
• esbuild 0.27.3 disappears from the lockfile (GHSA-g7r4-m6w7-qqqr). It was only ever present as an optional peer of vite 8, which builds on rolldown and does not need it; nothing in the workspace depends on it. Re-resolving drops it along with its 26 @esbuild/* platform packages, which is most of the lockfile's line-count reduction. vite build and vitest both run fine without it.

Not fixed: image-size

Two high advisories remain, both against image-size ≤ 2.0.2 — infinite loops in the ICNS (GHSA-w3rx-r6r6-pgpr) and JXL/HEIF (GHSA-5p2g-fcmc-qvqq) parsers. There is no patched release upstream — the advisories list no fixed version and 2.0.2 is the latest published. It reaches us via expo > @expo/metro > metro, so it only ever runs in the playground's dev bundler and is never part of the published SDK. Nothing to do until metro or image-size ships a fix. Happy to add a pnpm.auditConfig.ignoreGhsas entry for these two if you'd prefer pnpm audit to exit clean.

Test plan

All run locally on this branch:

• pnpm install --frozen-lockfile — lockfile is in sync
• pnpm lint — exact-deps check + Biome, clean
• pnpm check-types — clean across both workspaces
• pnpm test — 20 files, 195 tests passing
• pnpm test:coverage — passing
• pnpm build — SDK build + expo export for the playground both succeed
• pnpm audit — 56 → 2 advisories, both the unfixable image-size ones

🤖 Generated with Claude Code

https://claude.ai/code/session_0199vMNGkiRE4yFkvs2sGENL

---

Generated by Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 08eee37d-8865-4a5e-a033-2690cc78c924

📥 Commits

Reviewing files that changed from the base of the PR and between 7e0020e and 6a646e8.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• package.json
• packages/react-native/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pnpm overrides in package.json now contain 13 pinned dependency entries. The existing @xmldom/xmldom override changes from 0.9.10 to 0.9.12. The React Native package updates @vitest/coverage-v8 and vitest from 4.1.2 to 4.1.11. Other listed dependencies remain unchanged.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 6a646

No current dependency compatibility failure was identified; the change is ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: resolving fixable pnpm audit advisories through dependency updates and overrides.
Description check	✅ Passed	The description is directly related to the dependency security updates. It explains the advisories addressed, remaining unfixable advisories, dependency changes, and validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}