chore(test-app): clear fixture app security alerts

Merged
TH
5d ago
+28-23

Summary

Clears the fixable Dependabot alerts on examples/test-app/pnpm-lock.yaml (fixture app, not shipped to users). Overrides live in the test app's own pnpm-workspace.yaml. No direct dependency bump pulls the fixes (all come through expo/@expo/cli/postcss), so this edits overrides, major-scoped like the existing ones:

  • shell-quote 1.10.0 → 1.12.0 (^1.9.0 → ^1.11.0): #142
  • compression 1.8.1 → 1.8.2 (new compression@1: ^1.8.2): #137
  • source-map-js 1.2.1 → 1.2.2 (new source-map-js@1: ^1.2.2): #138
  • brace-expansion 5.0.9 → 5.0.12 (^5.0.9 → ^5.0.12): #91, #92, #93

Out of scope, left for maintainer dismissal: braces #136 and node-forge #135 (no patched release), and image-size #84/#85 (covered by patches/image-size@1.2.1.patch). image-size 2.0.3 is not a drop-in: metro 0.84 calls the 1.x path-based API, which 2.x moved to image-size/fromFile.

Every patched version is at least 8 days old (shell-quote 1.12.0 published 2026-10-02), so the default pnpm minimumReleaseAge is satisfied. 2 files touched.

Validation

Tested at f9bc285c3:

  • pnpm check:affected --run: all runnable checks passed (test-app typecheck/security are GitHub-authoritative there)
  • pnpm typecheck and pnpm security:test in examples/test-app: pass
  • pnpm why in examples/test-app shows one version each: shell-quote@1.12.0, compression@1.8.2, source-map-js@1.2.2, brace-expansion@5.0.12

🤖 Generated with Claude Code