fix(deps): resolve all open Dependabot alerts (#659-#681) by kherembourg · Pull Request #241 · Purchasely/Purchasely-ReactNative

kherembourg · 2026-05-22T15:51:50Z

Summary

Resolves all 23 currently open Dependabot alerts (#659 → #681) across the monorepo and both test-projects.

Changes

Root (`yarn.lock`)

Bump turbo to ^2.9.14 in packages/{amazon,google,huawei,android-player}/package.json (closes #669–#676, #679–#680 — login callback CSRF + Yarn Berry detection RCE)
Migrate the four sub-package turbo.json files from the v1 pipeline key to the v2 tasks key (Turbo 2.0 renamed it) so the config is valid for the bumped major version
Add/bump root resolutions:
- @babel/plugin-transform-modules-systemjs >=7.29.4 (#667, high)
- basic-ftp >=5.3.1 (#659, high)
- fast-xml-builder >=1.1.7 (#660, #662)
- ip-address >=10.1.1 (#665, medium)
- tmp >=0.2.6 (#681, high — arbitrary file/dir write via symlink, pulled via external-editor)

test-projects/expo-purchasely-test (npm overrides)

uuid >=11.1.1 (#678, medium)
ws >=8.20.1 (#677, medium)
fast-uri >=3.1.2 (#664, #666, high)

test-projects/rn-purchasely-test (npm overrides)

@babel/plugin-transform-modules-systemjs >=7.29.4 (#668, high)
fast-xml-builder >=1.1.7 (#661, #663)

Resolved versions (lockfiles)

Package	Version
turbo	2.9.14
@babel/plugin-transform-modules-systemjs	7.29.4
basic-ftp	6.0.1
fast-xml-builder	1.2.0
ip-address	10.2.0
tmp	0.2.7
uuid (expo)	14.0.0
ws (expo)	8.20.1
fast-uri (expo)	3.1.2

Review follow-ups

Greptile (P1) — Turbo v2 pipeline key: renamed pipeline → tasks in all four sub-package turbo.json files. Note: no script or CI job in this repo invokes turbo run, so there was no runtime breakage, but the config is now valid for the installed v2 major.
New alert #681 (tmp): appeared after the initial batch; added a tmp >=0.2.6 resolution.

Test plan

yarn install regenerates yarn.lock cleanly
npm install --package-lock-only regenerates both test-projects lockfiles (0 vulnerabilities)
yarn lint (0 errors)
yarn typecheck (0 errors)
yarn test — 4 suites, 139 tests pass
CI: lint, test, build-android, build-ios pass
Confirm Dependabot closes alerts #659–#681 after merge

🤖 Generated with Claude Code

greptile-apps · 2026-05-22T15:54:34Z

Greptile Summary

This PR resolves all 23 open Dependabot alerts across the monorepo and both test projects through Yarn workspace resolutions, npm overrides, lockfile regeneration, and a Turbo v1→v2 migration (pipeline → tasks in all four sub-package turbo.json files).

Root resolutions fix five high/medium CVEs (@babel/plugin-transform-modules-systemjs, basic-ftp, fast-xml-builder, ip-address, tmp) by raising their minimum versions; the four sub-packages correctly bump turbo to ^2.9.14 with the matching schema migration.
expo-purchasely-test overrides introduce fast-uri >=3.1.2, uuid >=11.1.1, and ws >=8.20.1; the uuid constraint resolves to v14 (removing xcode's previously-nested v7 install) and the ws constraint collapses several ws@6 nested installs to ws@8.20.1, both of which may warrant a local dev-build smoke test.
rn-purchasely-test overrides add @babel/plugin-transform-modules-systemjs >=7.29.4 and fast-xml-builder >=1.1.7; the lockfile update for fast-xml-builder is clean and brings in a new transitive dep (xml-naming@0.1.0).

Confidence Score: 5/5

Safe to merge — no source code changes, all published SDK packages are unaffected, and the security fixes are well-scoped.

Every change is a dependency version constraint or lockfile update. The main SDK source and all five published npm packages are untouched. The Turbo v2 migration is correctly applied. The two observations in the expo test project are confined to a demo app with no CI coverage and do not affect the published SDK.

test-projects/expo-purchasely-test/package.json — the uuid and ws overrides force large major-version jumps on packages previously using older nested installs; a local npx expo run:ios smoke test would confirm the dev environment still works after merge.

Important Files Changed

Filename	Overview
package.json	Adds five new Yarn workspace resolutions to fix high/medium Dependabot vulnerabilities; all entries are correctly scoped with >= lower-bounds
packages/amazon/turbo.json	Renames pipeline to tasks key to match Turbo v2 schema; correctly migrated
packages/amazon/package.json	Bumps turbo devDependency from ^1.10.7 to ^2.9.14 to address CSRF and Yarn Berry RCE alerts
test-projects/expo-purchasely-test/package.json	Adds npm overrides for fast-uri, uuid, and ws; uuid resolves to v14.0.0 (7 major versions above xcode's declared ^7.0.3 requirement), and ws resolves to 8.x for packages that previously nested ws@6
test-projects/rn-purchasely-test/package.json	Adds npm overrides for @babel/plugin-transform-modules-systemjs and fast-xml-builder; both resolve within compatible minor/patch ranges
test-projects/expo-purchasely-test/package-lock.json	Lockfile regenerated cleanly; ws@6 nested installs removed and hoisted to 8.20.1, xcode nested uuid@7.0.3 removed and replaced by hoisted uuid@14.0.0
test-projects/rn-purchasely-test/package-lock.json	Lockfile regenerated; @babel/plugin-transform-modules-systemjs updated to 7.29.4 and fast-xml-builder to 1.2.0 with new xml-naming peer dep

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
test-projects/expo-purchasely-test/package.json:35-36
**`uuid >=11.1.1` override removes xcode's pinned v7 install**

The lockfile shows that `xcode`'s previously-nested `uuid@7.0.3` install is eliminated by this override, and `xcode` will now consume the hoisted `uuid@14.0.0`. The `xcode` package declares `"uuid": "^7.0.3"` — a range far below v14. If `xcode` relies on any API surface that changed between major versions (e.g. the default export was dropped in v7, and further breaking changes may exist in v9+), iOS builds via `npx expo run:ios` could silently fail. Worth verifying locally that `npx expo run:ios` still compiles after `npm install`.

### Issue 2 of 2
test-projects/expo-purchasely-test/package.json:37
**`ws >=8.20.1` override forces 2 major-version jump on dev-server packages**

The lockfile shows that `@react-native/dev-middleware` and `react-native` each had a nested `ws@6.2.3` install, which are now removed in favour of the hoisted `ws@8.20.1`. This is a jump across two major versions for those consumers. While the primary WebSocket `message`/`send` API is stable, ws@7 and ws@8 introduced breaking changes to the `Server` constructor and event internals. If either package uses those changed APIs, Metro's hot-reload websocket connection will break in the dev environment. Consider validating with `npx expo start` after install.

_{Reviews (2): Last reviewed commit: "fix(deps): resolve tmp <0.2.6 alert (#68..." | Re-trigger Greptile}

Bump direct deps and add yarn resolutions / npm overrides to patch 22 open Dependabot alerts across the monorepo and the two test-projects. Root (yarn.lock): - turbo ^2.9.14 in packages/{amazon,google,huawei,android-player} (GHSA login callback CSRF #673-#676 + Yarn Berry detection RCE #669-#672 + root yarn.lock #679-#680) - resolutions added/bumped: - @babel/plugin-transform-modules-systemjs >=7.29.4 (#667 high) - basic-ftp >=5.3.1 (#659 high) - fast-xml-builder >=1.1.7 (#660, #662 high+medium) - ip-address >=10.1.1 (#665 medium) test-projects/expo-purchasely-test (npm overrides): - uuid >=11.1.1 (#678 medium) - ws >=8.20.1 (#677 medium) - fast-uri >=3.1.2 (#664, #666 high) test-projects/rn-purchasely-test (npm overrides): - @babel/plugin-transform-modules-systemjs >=7.29.4 (#668 high) - fast-xml-builder >=1.1.7 (#661, #663 high+medium) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The turbo bump to ^2.9.14 (#669-#676, #679-#680) makes the v1 `pipeline` key invalid — Turbo 2.0 renamed it to `tasks`. Rename it in the amazon, android-player, google and huawei turbo.json files so the config is valid for the installed major version. Addresses Greptile review (P1). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

New high-severity Dependabot alert #681: tmp <0.2.6 (arbitrary file/dir write via symlink), pulled transitively through external-editor. Add a root `tmp` resolution forcing >=0.2.6; yarn.lock now resolves tmp 0.2.7 and drops the obsolete os-tmpdir dependency. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kherembourg · 2026-06-01T10:05:26Z

Review follow-ups addressed in `8889328`

#	Source	Finding	Resolution
1	Greptile P1	Turbo v2 no longer recognizes the v1 `pipeline` key	`b6886ae` — renamed `pipeline` → `tasks` in `packages/{amazon,android-player,google,huawei}/turbo.json`. (No script/CI in this repo invokes `turbo run`, so there was no live breakage; the config is now valid for the installed v2 major.)
2	Dependabot (new)	Alert #681 — `tmp <0.2.6` (high, arbitrary file/dir write via symlink) appeared after the initial batch	`8889328` — added `tmp >=0.2.6` root resolution; `yarn.lock` now resolves `tmp 0.2.7` and drops obsolete `os-tmpdir`.

Local verification: yarn lint ✅ · yarn typecheck ✅ · yarn test → 4 suites / 139 tests ✅.

This PR now closes all 23 open Dependabot alerts (#659–#681).

kherembourg · 2026-06-01T10:05:30Z

@greptileai review

Copilot

Pull request overview

This PR addresses Dependabot security alerts across the monorepo by updating vulnerable transitive dependencies via Yarn resolutions / npm overrides, and by upgrading turbo to the v2 line with the corresponding config migration in affected packages.

Changes:

Bump turbo to ^2.9.14 in the Amazon/Google/Huawei/Android-player packages and migrate their turbo.json config key from pipeline → tasks.
Add/adjust root Yarn resolutions to force patched versions of vulnerable transitive dependencies (e.g., basic-ftp, tmp, ip-address, fast-xml-builder, @babel/plugin-transform-modules-systemjs) and regenerate yarn.lock.
Add npm overrides in both test projects to enforce patched versions (e.g., ws, uuid, fast-uri, fast-xml-builder) and regenerate package-lock.json files.

Reviewed changes

Copilot reviewed 11 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
yarn.lock	Regenerated lockfile reflecting patched transitive dependencies and the Turbo v2 upgrade.
package.json	Adds/bumps Yarn `resolutions` to enforce secure minimum versions (incl. `tmp`, `ip-address`, `fast-xml-builder`, Babel plugin).
test-projects/expo-purchasely-test/package.json	Adds npm `overrides` to force patched `fast-uri`, `uuid`, and `ws`.
test-projects/expo-purchasely-test/package-lock.json	Regenerated to reflect override-driven dependency upgrades (incl. `ws` / `uuid` / `fast-uri`).
test-projects/rn-purchasely-test/package.json	Adds npm `overrides` for patched `@babel/plugin-transform-modules-systemjs` and `fast-xml-builder`.
test-projects/rn-purchasely-test/package-lock.json	Regenerated to reflect override-driven upgrades (incl. `fast-xml-builder` and Babel plugin).
packages/amazon/package.json	Bumps `turbo` devDependency to `^2.9.14`.
packages/amazon/turbo.json	Migrates Turbo config key from `pipeline` to `tasks` for Turbo v2 compatibility.
packages/google/package.json	Bumps `turbo` devDependency to `^2.9.14`.
packages/google/turbo.json	Migrates Turbo config key from `pipeline` to `tasks` for Turbo v2 compatibility.
packages/huawei/package.json	Bumps `turbo` devDependency to `^2.9.14`.
packages/huawei/turbo.json	Migrates Turbo config key from `pipeline` to `tasks` for Turbo v2 compatibility.
packages/android-player/package.json	Bumps `turbo` devDependency to `^2.9.14`.
packages/android-player/turbo.json	Migrates Turbo config key from `pipeline` to `tasks` for Turbo v2 compatibility.

Files not reviewed (2)

test-projects/expo-purchasely-test/package-lock.json: Language not supported
test-projects/rn-purchasely-test/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

greptile-apps Bot reviewed May 22, 2026

View reviewed changes

Comment thread packages/amazon/package.json

kherembourg force-pushed the fix/dependabot-alerts-batch-may-2026 branch from 6ed157a to 252fef7 Compare June 1, 2026 09:54

kherembourg and others added 2 commits June 1, 2026 12:04

kherembourg changed the title ~~fix(deps): resolve all open Dependabot alerts (#659-#680)~~ fix(deps): resolve all open Dependabot alerts (#659-#681) Jun 1, 2026

kherembourg requested a review from Copilot June 1, 2026 10:06

Copilot started reviewing on behalf of kherembourg June 1, 2026 10:06 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

chouaibMo approved these changes Jun 1, 2026

View reviewed changes

kherembourg merged commit a681223 into main Jun 1, 2026
6 checks passed

kherembourg deleted the fix/dependabot-alerts-batch-may-2026 branch June 1, 2026 10:13

kherembourg mentioned this pull request Jun 1, 2026

feat(types): complete PurchaselyEventProperties with missing public event fields #242

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): resolve all open Dependabot alerts (#659-#681)#241

fix(deps): resolve all open Dependabot alerts (#659-#681)#241
kherembourg merged 3 commits into
mainfrom
fix/dependabot-alerts-batch-may-2026

kherembourg commented May 22, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 22, 2026 •

edited

Loading

Greptile Summary

Important Files Changed

Uh oh!

Uh oh!

kherembourg commented Jun 1, 2026

Uh oh!

kherembourg commented Jun 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

kherembourg commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Root (yarn.lock)

test-projects/expo-purchasely-test (npm overrides)

test-projects/rn-purchasely-test (npm overrides)

Resolved versions (lockfiles)

Review follow-ups

Test plan

Uh oh!

greptile-apps Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

kherembourg commented Jun 1, 2026

Review follow-ups addressed in 8889328

Uh oh!

kherembourg commented Jun 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kherembourg commented May 22, 2026 •

edited

Loading

Root (`yarn.lock`)

greptile-apps Bot commented May 22, 2026 •

edited

Loading

Review follow-ups addressed in `8889328`