PlanitarInc / rnfs-untar / 36897584083

92%

push

github

Resolve all 53 Dependabot alerts in the dev tree [CAP-3563] (#15)

Every open alert was transitive + development scope in package-lock.json.
No runtime dependency, peer dependency, or source file changed.

Root causes:
1. `react-native` was auto-installed as a wildcard peer (`*`) of
   `@dr.pogodin/react-native-fs` and resolved to 0.72.6, pulling in
   `@react-native-community/cli@11.3.7` and `metro@0.76.8`. That subtree
   accounted for ip, joi, shell-quote, fast-xml-parser, image-size, yaml,
   serve-static/send/on-headers, ws and browserslist.
2. Stale lockfile resolutions across the jest/jsdom subtree accounted for
   form-data, minimatch, brace-expansion, braces, micromatch, picomatch,
   cross-spawn, js-yaml and @babel/*.

Changes:
- Pin `react-native` 0.81.6 and `react` 19.1.4 as devDependencies, matching
  the versions iguide-app uses, so the peer no longer resolves to RN 0.72.
- Pin `typescript` ~5.9.2. A clean re-resolve otherwise pulls TypeScript
  6.0.3, which defaults `strict` to true and breaks compilation of the
  existing tests. The old lockfile had silently pinned 5.2.2.
- Regenerate package-lock.json: 1011 -> 481 packages.
- Bump the version to 1.5.1.

Note that `ip` (alert #4, high) has no upstream patch at all. It is resolved
only because the RN 0.81 bump drops the cli-doctor / cli-hermes subtree.

Verified: 57/57 tests pass against both @dr.pogodin/react-native-fs 2.40.3
and 2.36.2 (the peer-range floor, and the version iguide-app pins); npm audit
reports 0 vulnerabilities; the alert-snapshot verifier reports 53 cleared,
0 still vulnerable, 0 unverified.

34 of 40 branches covered (85.0%)

Branch coverage included in aggregate %.

108 of 114 relevant lines covered (94.74%)

311.37 hits per line