chore(security): bump dependencies to resolve Dependabot alerts by ignaciosantise · Pull Request #567 · reown-com/appkit-react-native

ignaciosantise · 2026-06-10T18:37:29Z

Summary

Addresses the 39 open Dependabot alerts: 33 patched by bumping pinned transitive-dependency versions to their first patched release, 6 dismissed (not exploitable in this tree, no published patch, or would break the build).

No source code and no published package manifests changed — only the root resolutions (Yarn, dev/CI-only, not published) and the example app's overrides, plus refreshed lockfiles. No packages/*/package.json was touched, so the published SDK's dependency contracts and compiled output are unchanged.

Patched (33)

Root `package.json` — `resolutions` + `turbo` devDep (14 alerts)

Package	Change	Severity
`shell-quote`	→ `1.8.4`	critical
`@xmldom/xmldom`	`0.8.12` → `0.8.13`	high ×4
`fast-uri`	→ `3.1.2`	high ×2
`@babel/plugin-transform-modules-systemjs`	→ `7.29.4`	high
`tmp`	`0.2.4` → `0.2.6`	high
`ws`	`^8.18.1` → `^8.20.1`	medium
`qs`	`6.14.2` → `6.15.2`	medium
`postcss`	`8.4.31` → `8.5.10`	medium
`turbo`	`2.5.5` → `2.9.14`	medium + low

Example app `examples/expo-multichain/package.json` — `overrides` (19 alerts)

Package	Change	Severity
`hono`	`4.12.12` → `4.12.21`	10 alerts (medium/low)
`@xmldom/xmldom`	`0.8.12` → `0.8.13`	high ×4
`fast-uri`	→ `3.1.2`	high ×2
`shell-quote`	→ `1.8.4`	critical
`postcss`	→ `8.5.10`	medium
`brace-expansion`	`5.0.5` → `5.0.6`	medium

Dismissed (6) — evaluated and intentionally excluded from the bumps

uuid (fix: ui changes in social webview to solve android issues #277, fix: refresh balance #273, medium) — bug is a missing buffer bounds check in v3/v5/v6 with a buf arg; all consumers use v4() without buf. Forcing 11.1.1 violates xcode/@expo/*/@metamask/utils ranges. → tolerable_risk.
ip-address (fix: siwe import #259, medium) — XSS lives in Address6 HTML-emitting methods; sole consumer socks is parse-only. Forcing 10.1.1 breaks socks' ^9.0.5 range. → tolerable_risk.
bigint-buffer (chore: prep for v1.0.0-beta.1 #95, chore: ui fixes #96, high) — transitive via @solana/web3.js; no published fix. → no_bandwidth.
ws in the example app (chore: small changes #272, medium) — the example has no metro.config.js to shim Node core modules. Forcing ws@8.20.1 as a single hoisted version makes Metro bundle ws's Node build (require('stream')) instead of the React-Native/browser shim, breaking expo export/expo run with "Unable to resolve module stream from ws/lib/stream.js". The override was removed from the example; the root ws bump is unaffected (apps/native has a resolver and bundles cleanly). → tolerable_risk.

Verification

✅ yarn install / npm install resolve cleanly
✅ yarn build (9/9 packages, turbo 2.9.14)
✅ yarn test (152 tests pass)
✅ yarn lint
✅ apps/native Metro bundle: web (2647 modules) + iOS (2947 modules)
✅ examples/expo-multichain expo export --platform ios → 4060 modules (after removing the ws override)

🤖 Generated with Claude Code

Patches 34 of 39 open Dependabot alerts via resolution/override bumps to the first patched release; no source changes. Root (resolutions + turbo devDep): - shell-quote -> 1.8.4 (critical) - @xmldom/xmldom 0.8.12 -> 0.8.13, fast-uri -> 3.1.2, @babel/plugin-transform-modules-systemjs -> 7.29.4 (high) - tmp 0.2.4 -> 0.2.6 (high) - ws ^8.18.1 -> ^8.20.1, qs 6.14.2 -> 6.15.2, postcss 8.4.31 -> 8.5.10 (medium) - turbo 2.5.5 -> 2.9.14 (medium/low) Example app (examples/expo-multichain overrides): - hono 4.12.12 -> 4.12.21 (10 alerts) - @xmldom/xmldom 0.8.13, fast-uri 3.1.2, shell-quote 1.8.4 (critical/high) - ws 8.20.1, postcss 8.5.10, brace-expansion 5.0.5 -> 5.0.6 (medium) The remaining 5 alerts are dismissed separately (not exploitable in this tree, or no published patch): uuid x2, ip-address, bigint-buffer x2. Verified: yarn build, yarn test, yarn lint all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

changeset-bot · 2026-06-10T18:37:33Z

⚠️ No Changeset found

Latest commit: 8772c2a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

claude · 2026-06-10T18:37:52Z

Claude finished @ignaciosantise's task in 2m 11s —— View job

Review complete

Gather context & read CLAUDE.md
Review changed files (package.json, yarn.lock, examples/expo-multichain/package.json, package-lock.json)
Run license compliance subagent
Run breaking changes subagent
Run data classification subagent
Consolidate findings & post review

✅ No issues found

Summary:

All bumps are patch/minor within the same major version — no breaking changes.
Approach correctly follows the repo's Dependabot guidance: direct deps updated in-place, transitive deps pinned via resolutions (root) and overrides (expo-multichain) — consistent with AGENTS.md §Dependabot Alerts.
All newly pinned packages (shell-quote, fast-uri, @babel/plugin-transform-modules-systemjs) carry permissive licenses (MIT/BSD-3-Clause).
No data classification concerns — only manifests and lockfiles changed.
The 5 dismissed alerts are justified: uuid (v4 callers don't pass buf), ip-address (HTML methods unused via socks), bigint-buffer (no published fix).

socket-security · 2026-06-10T18:38:27Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	turbo@2.5.5 ⏵ 2.9.14	⁺¹	⁺³	^-1	⁺¹

View full report

socket-security · 2026-06-10T18:38:29Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `eslint-plugin-react` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/@react-native/eslint-config@0.76.7` → `npm/eslint-plugin-react@7.37.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-react@7.37.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copilot

Pull request overview

This PR addresses Dependabot security alerts by bumping pinned transitive dependency versions via Yarn resolutions (repo root) and npm overrides (Expo example), and refreshing the corresponding lockfiles.

Changes:

Update root resolutions and devDependency turbo to patched versions (e.g., shell-quote, fast-uri, postcss, qs, tmp, @xmldom/xmldom, @babel/plugin-transform-modules-systemjs, ws).
Update Expo example app overrides to patched versions (e.g., hono, brace-expansion, @xmldom/xmldom, postcss, ws, etc.).
Refresh yarn.lock and the example app’s package-lock.json to reflect the new dependency graph.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
`package.json`	Bumps `turbo` and updates root Yarn `resolutions` to patched dependency versions.
`yarn.lock`	Regenerated Yarn lockfile reflecting updated root `resolutions`/dependency versions.
`examples/expo-multichain/package.json`	Updates npm `overrides` to patched versions for the example app.
`examples/expo-multichain/package-lock.json`	Regenerated npm lockfile reflecting updated example app overrides/dependency tree.

Files not reviewed (1)

examples/expo-multichain/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Forcing ws to a single hoisted version (8.20.1) changed Metro module resolution so the example bundles ws's Node build (which does `require('stream')`) instead of the React-Native/browser shim it used before. This broke `expo export`/`expo run` for the example with: "Unable to resolve module stream from .../ws/lib/stream.js". The example has no metro.config.js to shim Node core modules (unlike apps/native), so the ws security bump can't be applied here without breaking the bundle. Dropping the override restores a clean bundle (verified: `expo export --platform ios` -> 4060 modules, exit 0). The example's ws alert (#272) is dismissed separately as tolerable_risk (sample app, not published; patched ws breaks Metro resolution). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings June 10, 2026 18:37

Copilot started reviewing on behalf of ignaciosantise June 10, 2026 18:37 View session

Copilot AI reviewed Jun 10, 2026

View reviewed changes

Comment thread examples/expo-multichain/package.json

Comment thread examples/expo-multichain/package-lock.json

ignaciosantise merged commit c1b28b1 into develop Jun 10, 2026
9 checks passed

ignaciosantise deleted the chore/dependabot-security-bumps branch June 10, 2026 19:11

github-actions Bot locked and limited conversation to collaborators Jun 10, 2026

Navigation Menu

Uh oh!

chore(security): bump dependencies to resolve Dependabot alerts - #567

chore(security): bump dependencies to resolve Dependabot alerts#567
ignaciosantise merged 2 commits into
developfrom
chore/dependabot-security-bumps

ignaciosantise commented Jun 10, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ignaciosantise commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Patched (33)

Root package.json — resolutions + turbo devDep (14 alerts)

Example app examples/expo-multichain/package.json — overrides (19 alerts)

Dismissed (6) — evaluated and intentionally excluded from the bumps

Verification

Uh oh!

changeset-bot Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

claude Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review complete

Uh oh!

socket-security Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ignaciosantise commented Jun 10, 2026 •

edited

Loading

Root `package.json` — `resolutions` + `turbo` devDep (14 alerts)

Example app `examples/expo-multichain/package.json` — `overrides` (19 alerts)

changeset-bot Bot commented Jun 10, 2026 •

edited

Loading

claude Bot commented Jun 10, 2026 •

edited

Loading

socket-security Bot commented Jun 10, 2026 •

edited

Loading

socket-security Bot commented Jun 10, 2026 •

edited

Loading