From f88c9f8cd156d75118fe9e398c2983a59d544597 Mon Sep 17 00:00:00 2001 From: GioDavid Date: Thu, 24 Sep 2026 11:10:29 -0500 Subject: [PATCH 1/2] fix(security): remove vulnerable image-size via Metro 0.83.8 --- example/package.json | 2 +- package.json | 14 ++ yarn.lock | 560 +++++++++---------------------------------- 3 files changed, 129 insertions(+), 447 deletions(-) diff --git a/example/package.json b/example/package.json index 6e3838c..ac2d48f 100644 --- a/example/package.json +++ b/example/package.json @@ -49,7 +49,7 @@ "@rnx-kit/metro-resolver-symlinks": "^0.2.5", "@styled/typescript-styled-plugin": "^1.0.1", "@types/react": "^19.1.8", - "metro-config": "^0.82.4", + "metro-config": "^0.83.8", "serve": "^14.2.4", "typescript": "^5.8.3" }, diff --git a/package.json b/package.json index 688622f..7f82da1 100644 --- a/package.json +++ b/package.json @@ -27,6 +27,20 @@ }, "packageManager": "yarn@4.9.1", "resolutions": { + "metro": "0.83.8", + "metro-babel-transformer": "0.83.8", + "metro-cache": "0.83.8", + "metro-cache-key": "0.83.8", + "metro-config": "0.83.8", + "metro-core": "0.83.8", + "metro-file-map": "0.83.8", + "metro-minify-terser": "0.83.8", + "metro-resolver": "0.83.8", + "metro-runtime": "0.83.8", + "metro-source-map": "0.83.8", + "metro-symbolicate": "0.83.8", + "metro-transform-plugins": "0.83.8", + "metro-transform-worker": "0.83.8", "tar": "npm:7.5.22" }, "devDependencies": { diff --git a/yarn.lock b/yarn.lock index 013bfaf..feb03b8 100644 --- a/yarn.lock +++ b/yarn.lock @@ -68,7 +68,7 @@ __metadata: languageName: node linkType: hard -"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.12.13, @babel/code-frame@npm:^7.21.4, @babel/code-frame@npm:^7.24.7, @babel/code-frame@npm:^7.26.2, @babel/code-frame@npm:^7.29.0, @babel/code-frame@npm:^7.29.7": +"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.12.13, @babel/code-frame@npm:^7.21.4, @babel/code-frame@npm:^7.26.2, @babel/code-frame@npm:^7.29.0, @babel/code-frame@npm:^7.29.7": version: 7.29.7 resolution: "@babel/code-frame@npm:7.29.7" dependencies: @@ -109,7 +109,7 @@ __metadata: languageName: node linkType: hard -"@babel/generator@npm:^7.25.0, @babel/generator@npm:^7.29.1, @babel/generator@npm:^7.29.7": +"@babel/generator@npm:^7.29.1, @babel/generator@npm:^7.29.7": version: 7.29.7 resolution: "@babel/generator@npm:7.29.7" dependencies: @@ -873,7 +873,7 @@ __metadata: languageName: node linkType: hard -"@babel/template@npm:^7.25.0, @babel/template@npm:^7.28.6, @babel/template@npm:^7.29.7, @babel/template@npm:^7.3.3": +"@babel/template@npm:^7.28.6, @babel/template@npm:^7.29.7, @babel/template@npm:^7.3.3": version: 7.29.7 resolution: "@babel/template@npm:7.29.7" dependencies: @@ -884,7 +884,7 @@ __metadata: languageName: node linkType: hard -"@babel/traverse--for-generate-function-map@npm:@babel/traverse@^7.25.3, @babel/traverse@npm:^7.16.0, @babel/traverse@npm:^7.25.3, @babel/traverse@npm:^7.29.0, @babel/traverse@npm:^7.29.7": +"@babel/traverse@npm:^7.16.0, @babel/traverse@npm:^7.25.3, @babel/traverse@npm:^7.29.0, @babel/traverse@npm:^7.29.7": version: 7.29.7 resolution: "@babel/traverse@npm:7.29.7" dependencies: @@ -899,7 +899,7 @@ __metadata: languageName: node linkType: hard -"@babel/types@npm:^7.0.0, @babel/types@npm:^7.20.7, @babel/types@npm:^7.25.2, @babel/types@npm:^7.28.2, @babel/types@npm:^7.29.0, @babel/types@npm:^7.29.7, @babel/types@npm:^7.3.3": +"@babel/types@npm:^7.0.0, @babel/types@npm:^7.20.7, @babel/types@npm:^7.28.2, @babel/types@npm:^7.29.0, @babel/types@npm:^7.29.7, @babel/types@npm:^7.3.3": version: 7.29.7 resolution: "@babel/types@npm:7.29.7" dependencies: @@ -4109,16 +4109,6 @@ __metadata: languageName: node linkType: hard -"accepts@npm:^1.3.7, accepts@npm:~1.3.8": - version: 1.3.8 - resolution: "accepts@npm:1.3.8" - dependencies: - mime-types: "npm:~2.1.34" - negotiator: "npm:0.6.3" - checksum: 10/67eaaa90e2917c58418e7a9b89392002d2b1ccd69bcca4799135d0c632f3b082f23f4ae4ddeedbced5aa59bcc7bdf4699c69ebed4593696c922462b7bc5744d6 - languageName: node - linkType: hard - "accepts@npm:^2.0.0": version: 2.0.0 resolution: "accepts@npm:2.0.0" @@ -4129,6 +4119,16 @@ __metadata: languageName: node linkType: hard +"accepts@npm:~1.3.8": + version: 1.3.8 + resolution: "accepts@npm:1.3.8" + dependencies: + mime-types: "npm:~2.1.34" + negotiator: "npm:0.6.3" + checksum: 10/67eaaa90e2917c58418e7a9b89392002d2b1ccd69bcca4799135d0c632f3b082f23f4ae4ddeedbced5aa59bcc7bdf4699c69ebed4593696c922462b7bc5744d6 + languageName: node + linkType: hard + "acorn-jsx@npm:^5.3.2": version: 5.3.2 resolution: "acorn-jsx@npm:5.3.2" @@ -5168,31 +5168,6 @@ __metadata: languageName: node linkType: hard -"caller-callsite@npm:^2.0.0": - version: 2.0.0 - resolution: "caller-callsite@npm:2.0.0" - dependencies: - callsites: "npm:^2.0.0" - checksum: 10/b685e9d126d9247b320cfdfeb3bc8da0c4be28d8fb98c471a96bc51aab3130099898a2fe3bf0308f0fe048d64c37d6d09f563958b9afce1a1e5e63d879c128a2 - languageName: node - linkType: hard - -"caller-path@npm:^2.0.0": - version: 2.0.0 - resolution: "caller-path@npm:2.0.0" - dependencies: - caller-callsite: "npm:^2.0.0" - checksum: 10/3e12ccd0c71ec10a057aac69e3ec175b721ca858c640df021ef0d25999e22f7c1d864934b596b7d47038e9b56b7ec315add042abbd15caac882998b50102fb12 - languageName: node - linkType: hard - -"callsites@npm:^2.0.0": - version: 2.0.0 - resolution: "callsites@npm:2.0.0" - checksum: 10/be2f67b247df913732b7dec1ec0bbfcdbaea263e5a95968b19ec7965affae9496b970e3024317e6d4baa8e28dc6ba0cec03f46fdddc2fdcc51396600e53c2623 - languageName: node - linkType: hard - "callsites@npm:^3.0.0": version: 3.1.0 resolution: "callsites@npm:3.1.0" @@ -5808,18 +5783,6 @@ __metadata: languageName: node linkType: hard -"cosmiconfig@npm:^5.0.5": - version: 5.2.1 - resolution: "cosmiconfig@npm:5.2.1" - dependencies: - import-fresh: "npm:^2.0.0" - is-directory: "npm:^0.3.1" - js-yaml: "npm:^3.13.1" - parse-json: "npm:^4.0.0" - checksum: 10/1d617668e1367b8d66617fb8a1bd8c13e9598534959ac0cc86195b1b0cbe7afbba2b9faa300c60b9d9d35409cf4f064b0f6e377f4ea036434e5250c69c76932f - languageName: node - linkType: hard - "cosmiconfig@npm:^8.1.0": version: 8.3.6 resolution: "cosmiconfig@npm:8.3.6" @@ -7148,7 +7111,7 @@ __metadata: "@styled/typescript-styled-plugin": "npm:^1.0.1" "@types/react": "npm:^19.1.8" dedent: "npm:^1.6.0" - metro-config: "npm:^0.82.4" + metro-config: "npm:^0.83.8" react: "npm:19.2.3" react-dom: "npm:19.2.3" react-is: "npm:19.2.3" @@ -8000,13 +7963,6 @@ __metadata: languageName: node linkType: hard -"hermes-estree@npm:0.29.1": - version: 0.29.1 - resolution: "hermes-estree@npm:0.29.1" - checksum: 10/8989fc224fcd2bb3356d7d330461c9f32303904824891ae4befafc08f13c871013b18d5d4cd4b20bf6f59e9d26afdbb10d33440c6e646de770db4b9543c39db4 - languageName: node - linkType: hard - "hermes-estree@npm:0.32.0": version: 0.32.0 resolution: "hermes-estree@npm:0.32.0" @@ -8021,15 +7977,6 @@ __metadata: languageName: node linkType: hard -"hermes-parser@npm:0.29.1": - version: 0.29.1 - resolution: "hermes-parser@npm:0.29.1" - dependencies: - hermes-estree: "npm:0.29.1" - checksum: 10/2d1ada9d48817668bf12b31deef7c5a4a7d88419448c7e07ad67197a7992462dea3f5e536aea2c6f7e2222940f96bb7cd7a7dc5a101c9b4b2d7a84e1a1272670 - languageName: node - linkType: hard - "hermes-parser@npm:0.32.0": version: 0.32.0 resolution: "hermes-parser@npm:0.32.0" @@ -8236,27 +8183,6 @@ __metadata: languageName: node linkType: hard -"image-size@npm:^1.0.2": - version: 1.2.1 - resolution: "image-size@npm:1.2.1" - dependencies: - queue: "npm:6.0.2" - bin: - image-size: bin/image-size.js - checksum: 10/b290c6cc5635565b1da51991472eb6522808430dbe3415823649723dc5f5fd8263f0f98f9bdec46184274ea24fe4f3f7a297c84b647b412e14d2208703dd8a19 - languageName: node - linkType: hard - -"import-fresh@npm:^2.0.0": - version: 2.0.0 - resolution: "import-fresh@npm:2.0.0" - dependencies: - caller-path: "npm:^2.0.0" - resolve-from: "npm:^3.0.0" - checksum: 10/610255f9753cc6775df00be08e9f43691aa39f7703e3636c45afe22346b8b545e600ccfe100c554607546fc8e861fa149a0d1da078c8adedeea30fff326eef79 - languageName: node - linkType: hard - "import-fresh@npm:^3.2.1, import-fresh@npm:^3.3.0": version: 3.3.1 resolution: "import-fresh@npm:3.3.1" @@ -8526,13 +8452,6 @@ __metadata: languageName: node linkType: hard -"is-directory@npm:^0.3.1": - version: 0.3.1 - resolution: "is-directory@npm:0.3.1" - checksum: 10/dce9a9d3981e38f2ded2a80848734824c50ee8680cd09aa477bef617949715cfc987197a2ca0176c58a9fb192a1a0d69b535c397140d241996a609d5906ae524 - languageName: node - linkType: hard - "is-docker@npm:^2.0.0": version: 2.2.1 resolution: "is-docker@npm:2.2.1" @@ -9872,130 +9791,70 @@ __metadata: languageName: node linkType: hard -"metro-babel-transformer@npm:0.82.5": - version: 0.82.5 - resolution: "metro-babel-transformer@npm:0.82.5" - dependencies: - "@babel/core": "npm:^7.25.2" - flow-enums-runtime: "npm:^0.0.6" - hermes-parser: "npm:0.29.1" - nullthrows: "npm:^1.1.1" - checksum: 10/1eea9e96292ee86b14158ac6de07278a87191eeb993f3f01a42a5a2bcaa54406cacf0093a4923ec6c3cc409e4c081d301ec6afcc4b3577890f6d1b5ef39bc81f - languageName: node - linkType: hard - -"metro-babel-transformer@npm:0.83.7": - version: 0.83.7 - resolution: "metro-babel-transformer@npm:0.83.7" +"metro-babel-transformer@npm:0.83.8": + version: 0.83.8 + resolution: "metro-babel-transformer@npm:0.83.8" dependencies: "@babel/core": "npm:^7.25.2" flow-enums-runtime: "npm:^0.0.6" hermes-parser: "npm:0.35.0" - metro-cache-key: "npm:0.83.7" + metro-cache-key: "npm:0.83.8" nullthrows: "npm:^1.1.1" - checksum: 10/b213f9479daf690b11117c63a628e036ffcbb993fee571565142a34c9ae5c7ef1839eb7759c676d910edd58c1f442337f4d834de794904397091205f275b7f24 + checksum: 10/7b01758ccd0cbf6472795ef2c6a5ae90506779d623562685bf624c21e90ea33967bccf3572eca466ab2c3d2ab9f877e279477a4b3c170295011700f19748bcc8 languageName: node linkType: hard -"metro-cache-key@npm:0.82.5": - version: 0.82.5 - resolution: "metro-cache-key@npm:0.82.5" +"metro-cache-key@npm:0.83.8": + version: 0.83.8 + resolution: "metro-cache-key@npm:0.83.8" dependencies: flow-enums-runtime: "npm:^0.0.6" - checksum: 10/d5dcd86249905c7adad0375111a4bef395a5021df251a463f840eb21bf7b34f4e581ae919a88fb612a63c48a5f379ce50f104a576bd71e052693d89ae6a0d9f0 + checksum: 10/785851646f1e59c261d909aedd21f3c9f7668bf7a44812b551926df98a6ced92418722860cba2ed33bbbcd6482c245d10012234c25a6820ac541002297adf9d9 languageName: node linkType: hard -"metro-cache-key@npm:0.83.7": - version: 0.83.7 - resolution: "metro-cache-key@npm:0.83.7" - dependencies: - flow-enums-runtime: "npm:^0.0.6" - checksum: 10/bc0110eb61ce5903dae3992528f6933146889883d0999f8f01464a3b5bdd255dffa6a562bb921738004194cdf55d175b96cfaffdc17a5df6468c629b22ff7286 - languageName: node - linkType: hard - -"metro-cache@npm:0.82.5": - version: 0.82.5 - resolution: "metro-cache@npm:0.82.5" +"metro-cache@npm:0.83.8": + version: 0.83.8 + resolution: "metro-cache@npm:0.83.8" dependencies: exponential-backoff: "npm:^3.1.1" flow-enums-runtime: "npm:^0.0.6" https-proxy-agent: "npm:^7.0.5" - metro-core: "npm:0.82.5" - checksum: 10/e90299ae6e411349e5283c57a69ec0d4dd8a4424c3a85078d72d740b425b3dfc77078601ab426e6fb35bcb985e835374846e89f9730f4db413424bd48d9df863 - languageName: node - linkType: hard - -"metro-cache@npm:0.83.7": - version: 0.83.7 - resolution: "metro-cache@npm:0.83.7" - dependencies: - exponential-backoff: "npm:^3.1.1" - flow-enums-runtime: "npm:^0.0.6" - https-proxy-agent: "npm:^7.0.5" - metro-core: "npm:0.83.7" - checksum: 10/3f080c954fcb6e5894f7b6c4d7d8cdf03ecd1a5c175a5dcdb2d9c1751f135f7fdadea3014456524288baa3a4504a313bfd7872080f75b4da2f7c60c91b6bd88e - languageName: node - linkType: hard - -"metro-config@npm:0.82.5, metro-config@npm:^0.82.4": - version: 0.82.5 - resolution: "metro-config@npm:0.82.5" - dependencies: - connect: "npm:^3.6.5" - cosmiconfig: "npm:^5.0.5" - flow-enums-runtime: "npm:^0.0.6" - jest-validate: "npm:^29.7.0" - metro: "npm:0.82.5" - metro-cache: "npm:0.82.5" - metro-core: "npm:0.82.5" - metro-runtime: "npm:0.82.5" - checksum: 10/91e7860a6a3dfaf7287d5abe553fec1592699f92c756fae1218e0cad5a027396b16d4ba7edea75a9fac26c431f719858c9ae17ed737e54605969730c338eb07f + metro-core: "npm:0.83.8" + checksum: 10/bbec88008bba26f1f13e07f694726d3100c08968bf165fe72e2639f54fe5e868a220ec863de6b7fa7ecb7664cbebe6f46a5756152513c783167a1d82d91b595b languageName: node linkType: hard -"metro-config@npm:0.83.7, metro-config@npm:^0.83.3": - version: 0.83.7 - resolution: "metro-config@npm:0.83.7" +"metro-config@npm:0.83.8": + version: 0.83.8 + resolution: "metro-config@npm:0.83.8" dependencies: connect: "npm:^3.6.5" flow-enums-runtime: "npm:^0.0.6" jest-validate: "npm:^29.7.0" - metro: "npm:0.83.7" - metro-cache: "npm:0.83.7" - metro-core: "npm:0.83.7" - metro-runtime: "npm:0.83.7" + metro: "npm:0.83.8" + metro-cache: "npm:0.83.8" + metro-core: "npm:0.83.8" + metro-runtime: "npm:0.83.8" yaml: "npm:^2.6.1" - checksum: 10/e73a76b1b5a2bd27d1e1cd3b221ddef4ec7a19a00379bd9ad124038d7705810b75fcaa44a7dd6e20f70950c0309ed78f9510821bfe8fda7910dad93c827419c8 - languageName: node - linkType: hard - -"metro-core@npm:0.82.5": - version: 0.82.5 - resolution: "metro-core@npm:0.82.5" - dependencies: - flow-enums-runtime: "npm:^0.0.6" - lodash.throttle: "npm:^4.1.1" - metro-resolver: "npm:0.82.5" - checksum: 10/e97282e0164042d1206fee7ac764eddb33f02abb238c139f0d5804a284a2c9e40683293913e29c900b95ee257f85cd18803a07ab3143481bdddc436e137bdf05 + checksum: 10/0fd1adf65896f9f0a20a2cb89bb4a10c10de701a1da0b3a7eed88562eeb6508a18cba16302bbf057e94fd4f62e6415a95120966e34facf4b85fa379bcd7915d7 languageName: node linkType: hard -"metro-core@npm:0.83.7, metro-core@npm:^0.83.3": - version: 0.83.7 - resolution: "metro-core@npm:0.83.7" +"metro-core@npm:0.83.8": + version: 0.83.8 + resolution: "metro-core@npm:0.83.8" dependencies: flow-enums-runtime: "npm:^0.0.6" lodash.throttle: "npm:^4.1.1" - metro-resolver: "npm:0.83.7" - checksum: 10/afa1e5121452dcc9a882c96c04830a9a3062ea06a648c60e353df6ed568795c75c7c8e923e415777c2f88ed3ebb687daf21b1a98b169c4b509c71ac77046129b + metro-resolver: "npm:0.83.8" + checksum: 10/1b3e5fc383e0999420b14a716d2b863e2edfda14f434bfbea937afad47c51f3a071e358ba9ac1a1a3e4c5b23904b093a34951a13537e67ff95df2580c190a78a languageName: node linkType: hard -"metro-file-map@npm:0.82.5": - version: 0.82.5 - resolution: "metro-file-map@npm:0.82.5" +"metro-file-map@npm:0.83.8": + version: 0.83.8 + resolution: "metro-file-map@npm:0.83.8" dependencies: debug: "npm:^4.4.0" fb-watchman: "npm:^2.0.0" @@ -10006,169 +9865,75 @@ __metadata: micromatch: "npm:^4.0.4" nullthrows: "npm:^1.1.1" walker: "npm:^1.0.7" - checksum: 10/3228947bb567f0e3fee200df55315928fac527a8ce4a5e95de44d3e3a125b153b49e4f8f4f59748842880848a5dd87ac8907e75b55786298fb2e2b4b2581d882 - languageName: node - linkType: hard - -"metro-file-map@npm:0.83.7": - version: 0.83.7 - resolution: "metro-file-map@npm:0.83.7" - dependencies: - debug: "npm:^4.4.0" - fb-watchman: "npm:^2.0.0" - flow-enums-runtime: "npm:^0.0.6" - graceful-fs: "npm:^4.2.4" - invariant: "npm:^2.2.4" - jest-worker: "npm:^29.7.0" - micromatch: "npm:^4.0.4" - nullthrows: "npm:^1.1.1" - walker: "npm:^1.0.7" - checksum: 10/175fee3f2d407bbc01b6312ecab63ce515d3d7de97c9404a563a390c24d03074cd3e983d46d31dba56806dda53c52adc4c40ec29d23dd620e82f43f8f36db371 - languageName: node - linkType: hard - -"metro-minify-terser@npm:0.82.5": - version: 0.82.5 - resolution: "metro-minify-terser@npm:0.82.5" - dependencies: - flow-enums-runtime: "npm:^0.0.6" - terser: "npm:^5.15.0" - checksum: 10/754c150f0928460e1254e90e4e11bd87e069a0b286d21906758cb71fb8b4ec50dc8f78337bf8a9f8a28ddbd34230f5c66dad0fecf18dbe49715bf1300e5318c2 + checksum: 10/8322df1c998ea560ba2f19a9fcc048a178995d099ba1b6aa04eca746a21c1426587042af79bbd7bd83362066784a1fffc6dd4ae8ffac1c6ba5ca72ffa10f6b9b languageName: node linkType: hard -"metro-minify-terser@npm:0.83.7": - version: 0.83.7 - resolution: "metro-minify-terser@npm:0.83.7" +"metro-minify-terser@npm:0.83.8": + version: 0.83.8 + resolution: "metro-minify-terser@npm:0.83.8" dependencies: flow-enums-runtime: "npm:^0.0.6" terser: "npm:^5.15.0" - checksum: 10/195bc658adbd4b49e13e4df6c00bbabd868a9449def0ee8d87d2706868e10731c337697130381a07e4477bb67f2d2f16dea2f369a1bdb80f78e15a0c4abab70b - languageName: node - linkType: hard - -"metro-resolver@npm:0.82.5": - version: 0.82.5 - resolution: "metro-resolver@npm:0.82.5" - dependencies: - flow-enums-runtime: "npm:^0.0.6" - checksum: 10/2ccabf3d9e1f931496b0cbc7075713b79cd6989f802607c845d2ce2fb0a1eeab8133d045fd92d8654ce7a943a276b2ab59e9e1039c9b6744a26d0107554d6f2f + checksum: 10/2255f9bb7b2a5e7fa292688543816ed1d10c813fa10247a7725a607dd74329dae27add7d963106151e953a03e1250f597a90788fdac56de437cf2f2bd05f2391 languageName: node linkType: hard -"metro-resolver@npm:0.83.7": - version: 0.83.7 - resolution: "metro-resolver@npm:0.83.7" +"metro-resolver@npm:0.83.8": + version: 0.83.8 + resolution: "metro-resolver@npm:0.83.8" dependencies: flow-enums-runtime: "npm:^0.0.6" - checksum: 10/cf29c2e05a0cf1455be40ee66cf47d8876c41f3412eec68c6d168455d0bbe3f40501bc40d5862be2e526fc82900ee9216b8f85596bc343f5e69ddc841978a2d9 - languageName: node - linkType: hard - -"metro-runtime@npm:0.82.5": - version: 0.82.5 - resolution: "metro-runtime@npm:0.82.5" - dependencies: - "@babel/runtime": "npm:^7.25.0" - flow-enums-runtime: "npm:^0.0.6" - checksum: 10/212ae207e507fa5fdac81ba079ccb4f6939dcea19416435885f16c173711b71f72eb4269eeb78ffde451e2307b6b01dbe7fc7b8cca117729a67ad4773b9e2d2d + checksum: 10/2717fe862c3c051f27a39518084bc43350970566517582bf7676c66bb5d1c0a02d65d83228641b843adb3cda8b09c40a1f53951181734e0cd66c22abd084e008 languageName: node linkType: hard -"metro-runtime@npm:0.83.7, metro-runtime@npm:^0.83.3": - version: 0.83.7 - resolution: "metro-runtime@npm:0.83.7" +"metro-runtime@npm:0.83.8": + version: 0.83.8 + resolution: "metro-runtime@npm:0.83.8" dependencies: "@babel/runtime": "npm:^7.25.0" flow-enums-runtime: "npm:^0.0.6" - checksum: 10/4d7f57ff4ae50d56eb857293ae3d16c76df07b14852c6f697719602cc9fdd43906df9a11b6340b78ca3ad324cd87646a238dc9ab3061387023ba68c80efae6ab + checksum: 10/5c8ebf7584b6cad9f64a16811e64b934c0482adb97c1090ca77e267f184914db025cfbff88718e0bf9c851ec21052df699704292c5e7f318da550133a30f9389 languageName: node linkType: hard -"metro-source-map@npm:0.82.5": - version: 0.82.5 - resolution: "metro-source-map@npm:0.82.5" - dependencies: - "@babel/traverse": "npm:^7.25.3" - "@babel/traverse--for-generate-function-map": "npm:@babel/traverse@^7.25.3" - "@babel/types": "npm:^7.25.2" - flow-enums-runtime: "npm:^0.0.6" - invariant: "npm:^2.2.4" - metro-symbolicate: "npm:0.82.5" - nullthrows: "npm:^1.1.1" - ob1: "npm:0.82.5" - source-map: "npm:^0.5.6" - vlq: "npm:^1.0.0" - checksum: 10/8731c6257afa7bf2b460d4059d7fea1498c91d982b09e536e6dda73e166c7155ceea2eb7709dbea6d1e10a59be746ec9a7b3e5000e5cc79fd38d30d833c181c6 - languageName: node - linkType: hard - -"metro-source-map@npm:0.83.7, metro-source-map@npm:^0.83.3": - version: 0.83.7 - resolution: "metro-source-map@npm:0.83.7" +"metro-source-map@npm:0.83.8": + version: 0.83.8 + resolution: "metro-source-map@npm:0.83.8" dependencies: "@babel/traverse": "npm:^7.29.0" "@babel/types": "npm:^7.29.0" flow-enums-runtime: "npm:^0.0.6" invariant: "npm:^2.2.4" - metro-symbolicate: "npm:0.83.7" - nullthrows: "npm:^1.1.1" - ob1: "npm:0.83.7" - source-map: "npm:^0.5.6" - vlq: "npm:^1.0.0" - checksum: 10/f1f8d5a411d65f14ffe2778229bc5236b57028bfc9821808f353f56fbe6344050b403b5fa843618cb086c6043028a96b4206c2dea870d4b1d03ee1d85e52e7c6 - languageName: node - linkType: hard - -"metro-symbolicate@npm:0.82.5": - version: 0.82.5 - resolution: "metro-symbolicate@npm:0.82.5" - dependencies: - flow-enums-runtime: "npm:^0.0.6" - invariant: "npm:^2.2.4" - metro-source-map: "npm:0.82.5" + metro-symbolicate: "npm:0.83.8" nullthrows: "npm:^1.1.1" + ob1: "npm:0.83.8" source-map: "npm:^0.5.6" vlq: "npm:^1.0.0" - bin: - metro-symbolicate: src/index.js - checksum: 10/593e853b702f3ff2d3f9e6677fcfef832cf3373506a6116a9ec5e3d3f6ab46f83af34167cfd6d53a52cda2238a504b7bac63436dc8b59a6c5d3da54bce9140ad + checksum: 10/7598cb7431e207ec4a22dbb8d1541e6a17fddaa0a21a440c62947df33d7cbe9b928fec31a76096c9bcc9abfd61dcda6be0ea95689fc26f9abbf21c8652c80cab languageName: node linkType: hard -"metro-symbolicate@npm:0.83.7": - version: 0.83.7 - resolution: "metro-symbolicate@npm:0.83.7" +"metro-symbolicate@npm:0.83.8": + version: 0.83.8 + resolution: "metro-symbolicate@npm:0.83.8" dependencies: flow-enums-runtime: "npm:^0.0.6" invariant: "npm:^2.2.4" - metro-source-map: "npm:0.83.7" + metro-source-map: "npm:0.83.8" nullthrows: "npm:^1.1.1" source-map: "npm:^0.5.6" vlq: "npm:^1.0.0" bin: metro-symbolicate: src/index.js - checksum: 10/a371abce2c8cf5d61aeeceeb36b342f7ddb5bc178d8aa73e8df679c4c0698e93022c090776414413aff0c9b6027cec3fb1067ea91baa1af1ee63bc1221b7aa0f + checksum: 10/76bb303ab87d8c35f681e256182ff70c3b8c52da9cdba962f9aa4a378c95aab3ab99571dcaacd98848171749b96a0e8a6f255d718e411ca3c82d6428a43426f8 languageName: node linkType: hard -"metro-transform-plugins@npm:0.82.5": - version: 0.82.5 - resolution: "metro-transform-plugins@npm:0.82.5" - dependencies: - "@babel/core": "npm:^7.25.2" - "@babel/generator": "npm:^7.25.0" - "@babel/template": "npm:^7.25.0" - "@babel/traverse": "npm:^7.25.3" - flow-enums-runtime: "npm:^0.0.6" - nullthrows: "npm:^1.1.1" - checksum: 10/413811c1e2cef44ba77f02f3cd823e8987bdfc69b3c051bd41e886f9243fa131fa4a366e34c9483c85e77c8960d5151eecb34924c0f66b3e0f87706ca6ff37c5 - languageName: node - linkType: hard - -"metro-transform-plugins@npm:0.83.7": - version: 0.83.7 - resolution: "metro-transform-plugins@npm:0.83.7" +"metro-transform-plugins@npm:0.83.8": + version: 0.83.8 + resolution: "metro-transform-plugins@npm:0.83.8" dependencies: "@babel/core": "npm:^7.25.2" "@babel/generator": "npm:^7.29.1" @@ -10176,105 +9941,34 @@ __metadata: "@babel/traverse": "npm:^7.29.0" flow-enums-runtime: "npm:^0.0.6" nullthrows: "npm:^1.1.1" - checksum: 10/df2a7140ed83c78dddcf2c86f26a642318df1827a51f019f8bed5636167bbf86e483eede0cc68afc1e87c9da51d48d2bf75635c55d125a345769d3869d7feb31 + checksum: 10/bb0d80727963c91f9899fcc0561951baa9674e28f65f943f4c3af8b60bdb9216407762ee854171b485f2b7e0c99c12219a1a1bfa5674bb2d8b0a2a89f3daf0cd languageName: node linkType: hard -"metro-transform-worker@npm:0.82.5": - version: 0.82.5 - resolution: "metro-transform-worker@npm:0.82.5" - dependencies: - "@babel/core": "npm:^7.25.2" - "@babel/generator": "npm:^7.25.0" - "@babel/parser": "npm:^7.25.3" - "@babel/types": "npm:^7.25.2" - flow-enums-runtime: "npm:^0.0.6" - metro: "npm:0.82.5" - metro-babel-transformer: "npm:0.82.5" - metro-cache: "npm:0.82.5" - metro-cache-key: "npm:0.82.5" - metro-minify-terser: "npm:0.82.5" - metro-source-map: "npm:0.82.5" - metro-transform-plugins: "npm:0.82.5" - nullthrows: "npm:^1.1.1" - checksum: 10/169203ececd0aa4c3d323f0579398ce9b77d3775d046cfa163c53d3dea97425dba6362b7630889fc8eea8232aa7567489f7e4e512ca3f58777c51f5f5e2894dc - languageName: node - linkType: hard - -"metro-transform-worker@npm:0.83.7": - version: 0.83.7 - resolution: "metro-transform-worker@npm:0.83.7" +"metro-transform-worker@npm:0.83.8": + version: 0.83.8 + resolution: "metro-transform-worker@npm:0.83.8" dependencies: "@babel/core": "npm:^7.25.2" "@babel/generator": "npm:^7.29.1" "@babel/parser": "npm:^7.29.0" "@babel/types": "npm:^7.29.0" flow-enums-runtime: "npm:^0.0.6" - metro: "npm:0.83.7" - metro-babel-transformer: "npm:0.83.7" - metro-cache: "npm:0.83.7" - metro-cache-key: "npm:0.83.7" - metro-minify-terser: "npm:0.83.7" - metro-source-map: "npm:0.83.7" - metro-transform-plugins: "npm:0.83.7" - nullthrows: "npm:^1.1.1" - checksum: 10/f99098f488782e25248e065e71ee72b413b08a855aafb672b1d62eaa53ab7570a475f560f65b22112ffa9f6b7129d843f5b2022f441377066c674e0bedc0b58c - languageName: node - linkType: hard - -"metro@npm:0.82.5": - version: 0.82.5 - resolution: "metro@npm:0.82.5" - dependencies: - "@babel/code-frame": "npm:^7.24.7" - "@babel/core": "npm:^7.25.2" - "@babel/generator": "npm:^7.25.0" - "@babel/parser": "npm:^7.25.3" - "@babel/template": "npm:^7.25.0" - "@babel/traverse": "npm:^7.25.3" - "@babel/types": "npm:^7.25.2" - accepts: "npm:^1.3.7" - chalk: "npm:^4.0.0" - ci-info: "npm:^2.0.0" - connect: "npm:^3.6.5" - debug: "npm:^4.4.0" - error-stack-parser: "npm:^2.0.6" - flow-enums-runtime: "npm:^0.0.6" - graceful-fs: "npm:^4.2.4" - hermes-parser: "npm:0.29.1" - image-size: "npm:^1.0.2" - invariant: "npm:^2.2.4" - jest-worker: "npm:^29.7.0" - jsc-safe-url: "npm:^0.2.2" - lodash.throttle: "npm:^4.1.1" - metro-babel-transformer: "npm:0.82.5" - metro-cache: "npm:0.82.5" - metro-cache-key: "npm:0.82.5" - metro-config: "npm:0.82.5" - metro-core: "npm:0.82.5" - metro-file-map: "npm:0.82.5" - metro-resolver: "npm:0.82.5" - metro-runtime: "npm:0.82.5" - metro-source-map: "npm:0.82.5" - metro-symbolicate: "npm:0.82.5" - metro-transform-plugins: "npm:0.82.5" - metro-transform-worker: "npm:0.82.5" - mime-types: "npm:^2.1.27" + metro: "npm:0.83.8" + metro-babel-transformer: "npm:0.83.8" + metro-cache: "npm:0.83.8" + metro-cache-key: "npm:0.83.8" + metro-minify-terser: "npm:0.83.8" + metro-source-map: "npm:0.83.8" + metro-transform-plugins: "npm:0.83.8" nullthrows: "npm:^1.1.1" - serialize-error: "npm:^2.1.0" - source-map: "npm:^0.5.6" - throat: "npm:^5.0.0" - ws: "npm:^7.5.10" - yargs: "npm:^17.6.2" - bin: - metro: src/cli.js - checksum: 10/8ada9adce330756249103181c3f99331d095f53d0630a192fd1a2729543dfdc2b71aea024bfa6bba2b38e8c3afdc25b50a6aedb2b6bc4d73b45fbc0599494066 + checksum: 10/926e99d93908246a96fe94f4578fa550eab9edfd765fab37ca99c749f74f1cb55074d7f559a5e274aa1e6908a5f0e7a5716ad80fa2214c593fa36e6bf00783f6 languageName: node linkType: hard -"metro@npm:0.83.7, metro@npm:^0.83.3": - version: 0.83.7 - resolution: "metro@npm:0.83.7" +"metro@npm:0.83.8": + version: 0.83.8 + resolution: "metro@npm:0.83.8" dependencies: "@babel/code-frame": "npm:^7.29.0" "@babel/core": "npm:^7.25.2" @@ -10291,23 +9985,22 @@ __metadata: flow-enums-runtime: "npm:^0.0.6" graceful-fs: "npm:^4.2.4" hermes-parser: "npm:0.35.0" - image-size: "npm:^1.0.2" invariant: "npm:^2.2.4" jest-worker: "npm:^29.7.0" jsc-safe-url: "npm:^0.2.2" lodash.throttle: "npm:^4.1.1" - metro-babel-transformer: "npm:0.83.7" - metro-cache: "npm:0.83.7" - metro-cache-key: "npm:0.83.7" - metro-config: "npm:0.83.7" - metro-core: "npm:0.83.7" - metro-file-map: "npm:0.83.7" - metro-resolver: "npm:0.83.7" - metro-runtime: "npm:0.83.7" - metro-source-map: "npm:0.83.7" - metro-symbolicate: "npm:0.83.7" - metro-transform-plugins: "npm:0.83.7" - metro-transform-worker: "npm:0.83.7" + metro-babel-transformer: "npm:0.83.8" + metro-cache: "npm:0.83.8" + metro-cache-key: "npm:0.83.8" + metro-config: "npm:0.83.8" + metro-core: "npm:0.83.8" + metro-file-map: "npm:0.83.8" + metro-resolver: "npm:0.83.8" + metro-runtime: "npm:0.83.8" + metro-source-map: "npm:0.83.8" + metro-symbolicate: "npm:0.83.8" + metro-transform-plugins: "npm:0.83.8" + metro-transform-worker: "npm:0.83.8" mime-types: "npm:^3.0.1" nullthrows: "npm:^1.1.1" serialize-error: "npm:^2.1.0" @@ -10317,7 +10010,7 @@ __metadata: yargs: "npm:^17.6.2" bin: metro: src/cli.js - checksum: 10/c641c560fe2ca7a9d72028df044e16880966415b2139cc25617098b917f15fe32e349f2448c4b0e8d08cd655f4491eb3e09577cd360ea3fea98e9eb7dc56f444 + checksum: 10/c5d9d38559bbad1beea5d74497611c8e4167b336dac7390ae2218770fd2e549bedded6ccf864b8a0de995ac6742c6df90d811fb8608512a28a25df5d0c59b265 languageName: node linkType: hard @@ -10373,15 +10066,6 @@ __metadata: languageName: node linkType: hard -"mime-types@npm:^2.1.27, mime-types@npm:~2.1.34": - version: 2.1.35 - resolution: "mime-types@npm:2.1.35" - dependencies: - mime-db: "npm:1.52.0" - checksum: 10/89aa9651b67644035de2784a6e665fc685d79aba61857e02b9c8758da874a754aed4a9aced9265f5ed1171fd934331e5516b84a7f0218031b6fa0270eca1e51a - languageName: node - linkType: hard - "mime-types@npm:^3.0.0, mime-types@npm:^3.0.1": version: 3.0.2 resolution: "mime-types@npm:3.0.2" @@ -10391,6 +10075,15 @@ __metadata: languageName: node linkType: hard +"mime-types@npm:~2.1.34": + version: 2.1.35 + resolution: "mime-types@npm:2.1.35" + dependencies: + mime-db: "npm:1.52.0" + checksum: 10/89aa9651b67644035de2784a6e665fc685d79aba61857e02b9c8758da874a754aed4a9aced9265f5ed1171fd934331e5516b84a7f0218031b6fa0270eca1e51a + languageName: node + linkType: hard + "mime@npm:1.6.0": version: 1.6.0 resolution: "mime@npm:1.6.0" @@ -11117,21 +10810,12 @@ __metadata: languageName: node linkType: hard -"ob1@npm:0.82.5": - version: 0.82.5 - resolution: "ob1@npm:0.82.5" +"ob1@npm:0.83.8": + version: 0.83.8 + resolution: "ob1@npm:0.83.8" dependencies: flow-enums-runtime: "npm:^0.0.6" - checksum: 10/3faa161e5b5307188b6bbbf7e21727b1e434b8f6c31c51386808b2efd5e7238cf85a7ce71416d9a3f073625afb5a2212f80ec267996dc88fe086944adbb525d9 - languageName: node - linkType: hard - -"ob1@npm:0.83.7": - version: 0.83.7 - resolution: "ob1@npm:0.83.7" - dependencies: - flow-enums-runtime: "npm:^0.0.6" - checksum: 10/ae366176de833457e77db78b60f2c514550f16eb53a08f5c53bc660d0e5d3126d782107d71b77a49d3bfdc8b1c614320510efea5318864e6ed49d915f7ef4b89 + checksum: 10/b3e34f21f1288611f441564e027b36f206d887734a747ba561df82460eff0798a76ab98ee0955d060333ef425809f10d0a411936bf8fdce2e6d144a2a7c30a33 languageName: node linkType: hard @@ -12130,15 +11814,6 @@ __metadata: languageName: node linkType: hard -"queue@npm:6.0.2": - version: 6.0.2 - resolution: "queue@npm:6.0.2" - dependencies: - inherits: "npm:~2.0.3" - checksum: 10/3437954ef1442c86ff01a0fbe3dc6222838823b1ca97f37eff651bc20b868c0c2904424ef2c0d44cba46055f54b578f92866e573125dc9a5e8823d751e4d1585 - languageName: node - linkType: hard - "randombytes@npm:^2.0.0, randombytes@npm:^2.0.1, randombytes@npm:^2.0.5, randombytes@npm:^2.1.0": version: 2.1.0 resolution: "randombytes@npm:2.1.0" @@ -12775,13 +12450,6 @@ __metadata: languageName: node linkType: hard -"resolve-from@npm:^3.0.0": - version: 3.0.0 - resolution: "resolve-from@npm:3.0.0" - checksum: 10/c4189f1592a777f7d51c1ff6153df18b5d062c831fb0c623b4b87736c8a73c08e4eaab19e807399287040791f3e7aa0877f05f9d86739d3ef1ef0c727e9fe06c - languageName: node - linkType: hard - "resolve-from@npm:^4.0.0": version: 4.0.0 resolution: "resolve-from@npm:4.0.0" From a78660cddcefd26b6252a1b270b9e770b96dcb89 Mon Sep 17 00:00:00 2001 From: GioDavid Date: Fri, 25 Sep 2026 10:51:47 -0500 Subject: [PATCH 2/2] refactor(security): rely on Metro 0.83.8 resolution --- package.json | 14 -------------- yarn.lock | 10 +++++----- 2 files changed, 5 insertions(+), 19 deletions(-) diff --git a/package.json b/package.json index 7f82da1..688622f 100644 --- a/package.json +++ b/package.json @@ -27,20 +27,6 @@ }, "packageManager": "yarn@4.9.1", "resolutions": { - "metro": "0.83.8", - "metro-babel-transformer": "0.83.8", - "metro-cache": "0.83.8", - "metro-cache-key": "0.83.8", - "metro-config": "0.83.8", - "metro-core": "0.83.8", - "metro-file-map": "0.83.8", - "metro-minify-terser": "0.83.8", - "metro-resolver": "0.83.8", - "metro-runtime": "0.83.8", - "metro-source-map": "0.83.8", - "metro-symbolicate": "0.83.8", - "metro-transform-plugins": "0.83.8", - "metro-transform-worker": "0.83.8", "tar": "npm:7.5.22" }, "devDependencies": { diff --git a/yarn.lock b/yarn.lock index feb03b8..440b070 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9825,7 +9825,7 @@ __metadata: languageName: node linkType: hard -"metro-config@npm:0.83.8": +"metro-config@npm:0.83.8, metro-config@npm:^0.83.3, metro-config@npm:^0.83.8": version: 0.83.8 resolution: "metro-config@npm:0.83.8" dependencies: @@ -9841,7 +9841,7 @@ __metadata: languageName: node linkType: hard -"metro-core@npm:0.83.8": +"metro-core@npm:0.83.8, metro-core@npm:^0.83.3": version: 0.83.8 resolution: "metro-core@npm:0.83.8" dependencies: @@ -9888,7 +9888,7 @@ __metadata: languageName: node linkType: hard -"metro-runtime@npm:0.83.8": +"metro-runtime@npm:0.83.8, metro-runtime@npm:^0.83.3": version: 0.83.8 resolution: "metro-runtime@npm:0.83.8" dependencies: @@ -9898,7 +9898,7 @@ __metadata: languageName: node linkType: hard -"metro-source-map@npm:0.83.8": +"metro-source-map@npm:0.83.8, metro-source-map@npm:^0.83.3": version: 0.83.8 resolution: "metro-source-map@npm:0.83.8" dependencies: @@ -9966,7 +9966,7 @@ __metadata: languageName: node linkType: hard -"metro@npm:0.83.8": +"metro@npm:0.83.8, metro@npm:^0.83.3": version: 0.83.8 resolution: "metro@npm:0.83.8" dependencies: