fix(security): patch all fixable vulnerabilities across JS and Go apps - #306
Open
Nick Robinson (nickrobinson) wants to merge 5 commits into
Open
fix(security): patch all fixable vulnerabilities across JS and Go apps#306Nick Robinson (nickrobinson) wants to merge 5 commits into
Nick Robinson (nickrobinson) wants to merge 5 commits into
Conversation
JS apps (javascript-web, javascript-tui, electron, react-native, react-native-expo): - brace-expansion: override to ^5.0.8 (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg) - js-yaml: bump to ^4.3.0 (GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m) - postcss: bump to 8.5.23 (GHSA-r28c-9q8g-f849) - vite: bump to 6.4.3 (GHSA-v6wh-96g9-6wx3, GHSA-fx2h-pf6j-xcff) - undici: bump to 7.29.0 in electron (multiple CVEs) - shell-quote: override to ^1.9.0 in react-native/expo (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv) - ws: override to ^7.5.11 in react-native/expo (GHSA-96hv-2xvq-fx4p) - qs: bump to ^6.15.2 in react-native (GHSA-q8mj-m7cp-5q26) - form-data: pin to 4.0.6 in react-native-expo (GHSA-hmw2-7cc7-3qxx) - body-parser, @babel/core, joi, launch-editor: patched via npm audit fix Go app (go-tui): - golang.org/x/sys v0.38.0 → v0.47.0 - golang.org/x/term v0.37.0 → v0.45.0 - github.com/fxamacker/cbor/v2 v2.9.0 → v2.9.2 MANUAL INTERVENTION REQUIRED (react-native-expo): - 11 moderate vulnerabilities remain via uuid < 11.1.1 → xcode → @expo/config-plugins. Fix requires upgrading expo 55 → 57 (major version bump with breaking changes). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P27Qi85FyMZUdDXV5Ti7Uv
Nick Robinson (nickrobinson)
requested review from
a team and
Kristopher Johnson (kristopherjohnson)
as code owners
July 27, 2026 18:54
Copilot started reviewing on behalf of
Nick Robinson (nickrobinson)
July 27, 2026 18:54
View session
…nt compatibility
brace-expansion@5.x changed its CJS export from a bare function to an
object, which breaks minimatch@3.x (used by eslint@8-9) when it calls
`const expand = require('brace-expansion')`. The @typescript-eslint
nested brace-expansion@5.0.8 is handled correctly by npm's lockfile
resolution since @typescript-eslint requires ^5.0.2 explicitly.
Revert the global brace-expansion override to ^1.1.12 (1.x series) so
minimatch@3.x consumers remain compatible, while the @typescript-eslint
tree continues to use 5.0.8 via its own semver range.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P27Qi85FyMZUdDXV5Ti7Uv
Contributor
There was a problem hiding this comment.
Pull request overview
This PR patches automatically-fixable dependency vulnerabilities across the JavaScript-based quickstart apps and the Go TUI app by updating lockfiles and adding dependency overrides/resolutions to force patched transitive versions.
Changes:
- Added/updated npm
overridesand yarnresolutionsto pin/override vulnerable transitive packages (e.g.,brace-expansion,js-yaml,postcss,shell-quote,ws,qs,form-data). - Refreshed JS lockfiles (npm + yarn where applicable) to reflect patched dependency graphs and minor/patch bumps.
- Updated
go-tuimodule dependencies (golang.org/x/*,fxamacker/cbor) and correspondinggo.sum.
Reviewed changes
Copilot reviewed 6 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| react-native/yarn.lock | Updated yarn-locked transitive dependencies to patched versions. |
| react-native/package.json | Added/updated overrides/resolutions to force patched transitive packages. |
| react-native/package-lock.json | Updated npm lockfile to reflect patched dependency graph. |
| react-native-expo/package.json | Added/updated resolutions/overrides for patched transitive packages (and postcss bump). |
| react-native-expo/package-lock.json | Updated npm lockfile to reflect patched dependency graph and Expo-related dependency bumps. |
| javascript-web/package.json | Added brace-expansion override. |
| javascript-web/package-lock.json | Updated locked transitive deps (e.g., postcss, vite, js-yaml, brace-expansion). |
| javascript-tui/package.json | Added brace-expansion override. |
| javascript-tui/package-lock.json | Updated locked transitive deps (notably Babel ecosystem + js-yaml/brace-expansion). |
| go-tui/go.mod | Updated Go dependencies (and Go toolchain directive). |
| go-tui/go.sum | Added checksums for updated Go module versions. |
| electron/package.json | Added brace-expansion override. |
| electron/package-lock.json | Updated locked transitive deps to patched versions. |
Files not reviewed (5)
- electron/package-lock.json: Generated file
- javascript-tui/package-lock.json: Generated file
- javascript-web/package-lock.json: Generated file
- react-native-expo/package-lock.json: Generated file
- react-native/package-lock.json: Generated file
Comments suppressed due to low confidence (1)
react-native-expo/package.json:94
wsis forced to the 7.x line, but the lockfile shows multiple dependencies in this app requiringws^8.x(e.g.expo’s CLI andjsdom). Forcing a different major version can break those consumers; prefer overriding to a patched8.xversion instead (or remove the override if the resolved8.xis already patched), then regenerate the lockfile.
"ws": "^7.5.11",
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "brace-expansion": "^5.0.8", | ||
| "js-yaml": "^4.3.0", | ||
| "shell-quote": "^1.9.0", | ||
| "ws": "^7.5.11", |
The Go dependency updates had no associated CVEs and were not required for security patching. Rolling back to avoid unnecessarily raising the minimum Go toolchain version (go.mod go directive). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P27Qi85FyMZUdDXV5Ti7Uv
Contributor
Author
|
Thanks for the review, @Copilot. Addressed both items:
Generated by Claude Code |
macOS runners no longer include Xcode 16.4; all available versions are 26.x. Update to 26.3, matching the version already used by react-native-expo-ci.yml. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P27Qi85FyMZUdDXV5Ti7Uv
Contributor
Author
CI status updateAll Lint checks are now green. ✅ Build iOS was failing with: This is a pre-existing infrastructure issue — the macOS runners no longer carry Xcode 16.x. The Generated by Claude Code |
ws@7.x does not export WebSocketServer in the way @expo/cli expects, causing "TypeError: _ws(...).WebSocketServer is not a constructor" in both the Android and iOS builds. The CVE (GHSA-3h5q-q39x-f9x3) is fixed in ws@8.17.1+; use 8.x to match what @expo/cli requires. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P27Qi85FyMZUdDXV5Ti7Uv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches all automatically-fixable security vulnerabilities identified across the JavaScript and Go quickstart apps. All fixes are minor or patch version bumps; no major version upgrades were forced.
Vulnerabilities Fixed
brace-expansion^5.0.8in all JS appsjs-yaml^4.3.0postcss8.5.23vite6.4.3undici7.29.0(electron)shell-quote^1.9.0(react-native, react-native-expo)ws^7.5.11(react-native, react-native-expo)qs^6.15.2(react-native)form-data4.0.6(react-native-expo)body-parser,@babel/core,joi,launch-editornpm audit fixGo (
go-tui): Bumpedgolang.org/x/sys→ v0.47.0,golang.org/x/term→ v0.45.0,fxamacker/cbor/v2→ v2.9.2.Apps Patched
javascript-web— 0 vulnerabilities remainingjavascript-tui— 0 vulnerabilities remainingelectron— 0 vulnerabilities remainingreact-native— 0 vulnerabilities remainingreact-native-expo— 0 high/critical remaining (11 moderate remain — see below)go-tui— patch/minor deps updatedMANUAL INTERVENTION REQUIRED
react-native-expo— 11 moderate vulnerabilitiesRoot cause:
uuid < 11.1.1(GHSA-w5hq-g745-h8pq) is pulled in byxcode→@expo/config-plugins→expo.What was tried:
npm audit fixand addinguuid/xcodeoverrides — both fail because npm resolves the fix as requiringexpo@46.0.21(a downgrade) orexpo@57.x(a major version upgrade).Required fix: Upgrade
expofrom~55.0.xto~57.0.xalong with all matchingexpo-*packages. This is a major version bump with its own migration guide and potential breaking changes in the app.Generated by Claude Code