fix(security): patch JS dependency vulnerabilities across all apps

[Nick Robinson (nickrobinson)]

Summary

Patches all moderate and high severity CVEs across the five JavaScript/TypeScript apps. Every fix is a minor or patch version bump — no breaking changes are introduced to production code.

---

Vulnerability inventory & fixes

javascript-web · javascript-tui · electron

Severity	CVE	Package	Fix
Moderate	GHSA-jxxr-4gwj-5jf2	brace-expansion 5.0.2–5.0.5 (DoS)	lockfile updated to ≥5.0.6 via npm audit fix

react-native

Severity	CVE	Package	Fix
Moderate	GHSA-gh4j-gqv2-49f6	fast-xml-parser <5.7.0 (XMLBuilder injection)	@react-native-community/cli 20.0.0 → 20.1.3 (patch); fast-xml-parser override 5.5.6 → 5.8.0
High	multiple	@xmldom/xmldom ≤0.8.12	fixed by CLI bump to 20.1.3; override >=0.8.13
High	GHSA-c2qf-rxjj-qqgw	semver 7.0–7.5.1 (ReDoS)	override >=7.5.2
High	multiple	tar ≤7.5.10 (path traversal)	override 7.5.11
Moderate	GHSA-qx2v-qp2m-jg93	postcss <8.5.10 (XSS)	override >=8.5.10
Moderate	GHSA-776f-qx25-q3cc	xml2js <0.5.0 (prototype pollution)	override >=0.5.0
Low	GHSA-m6fv-jmcg-4jfg	send <0.19.0 (XSS)	override >=0.19.0
High	GHSA-jf85-cpcp-j695	lodash ≤4.17.23	override 4.18.1

react-native-expo

Severity	CVE	Package	Fix
Moderate	GHSA-gh4j-gqv2-49f6	fast-xml-parser <5.7.0	override 5.5.6 → 5.8.0
Moderate	GHSA-qx2v-qp2m-jg93	postcss <8.5.10	override >=8.5.10
High	GHSA-r8j9-4w4v-r6p2	fast-uri ≤3.1.1	override >=3.1.2
High	GHSA-gh4j-gqv2-49f6	fast-xml-builder ≤1.1.6	override >=1.1.7
High	GHSA-jf85-cpcp-j695	lodash ≤4.17.23	override 4.18.1
Moderate	GHSA-48c2-rrv3-qjmp	yaml 2.0–2.8.2 (stack overflow)	override >=2.9.0
High	multiple	@xmldom/xmldom ≤0.8.12	override >=0.8.13
Moderate	GHSA-jxxr-4gwj-5jf2	brace-expansion 1.x/2.x (DoS)	npm audit fix updated lockfile

All overrides are mirrored in both overrides (npm) and resolutions (yarn) so both lockfiles receive the patched versions. Both package-lock.json and yarn.lock updated in react-native and react-native-expo per repo convention.

---

What was NOT patched (and why)

App	Package	Reason
react-native-expo	jest-expo chain (@tootallnate/once, http-proxy-agent, jsdom, jest-environment-jsdom) — 5 × low	Fix requires downgrading jest-expo from 53.x → 47.x (major breaking change); test-only, low severity

---

Ecosystem coverage

Non-JS ecosystems (Rust, Kotlin, Android, Flutter, .NET, Go, C++) have no publicly reachable Dependabot advisories that can be resolved with a patch/minor bump at this time. Gradle version catalogs and pubspec.yaml were reviewed and are current within their declared ranges.

Test plan

• cd javascript-web && npm audit — 0 vulnerabilities
• cd javascript-tui && npm audit — 0 vulnerabilities
• cd electron && npm audit — 0 vulnerabilities
• cd react-native && npm audit — 0 vulnerabilities
• cd react-native-expo && npm audit — 5 low (jest-expo chain, expected)
• Existing app functionality unaffected (all changes are transitive dev/build deps or lockfile resolutions)

https://claude.ai/code/session_01MQ2iqSwBd4djxD1AwWcPmc

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR updates dependency lockfiles and adds npm/yarn override policies to remediate reported moderate/high severity vulnerabilities across the JavaScript/TypeScript apps in the repo (notably the React Native and Expo React Native samples), aiming to keep changes within non-breaking upgrade ranges.

Changes:

• Updated react-native to bump @react-native-community/cli to 20.1.3 and introduced matching resolutions (Yarn) and overrides (npm) for several vulnerable transitive packages.
• Updated react-native-expo to add additional resolutions/overrides (fast-xml-parser/postcss/fast-uri/fast-xml-builder/yaml/@xmldom/xmldom/lodash) and refreshed both lockfiles.
• Updated brace-expansion in the javascript-web, javascript-tui, and electron lockfiles via audit-driven lockfile changes.

Reviewed changes

Copilot reviewed 2 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
react-native/package.json	Adds/updates resolutions + overrides and bumps React Native CLI packages.
react-native/yarn.lock	Updates resolved dependency graph for the React Native app.
react-native-expo/package.json	Adds/updates resolutions + overrides for Expo React Native app security patches.
react-native-expo/yarn.lock	Updates resolved dependency graph; includes an override-driven @xmldom/xmldom version jump.
react-native-expo/package-lock.json	Updates npm-resolved dependency graph for Expo React Native app.
javascript-web/package-lock.json	Lockfile-only updates (incl. patched brace-expansion).
javascript-tui/package-lock.json	Lockfile-only updates (incl. patched brace-expansion).
electron/package-lock.json	Lockfile-only updates (incl. patched brace-expansion and other transitive changes).

Files not reviewed (4)

• electron/package-lock.json: Language not supported
• javascript-tui/package-lock.json: Language not supported
• javascript-web/package-lock.json: Language not supported
• react-native-expo/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.