Security patches: fix qs DoS vuln + JS dependency updates

[Nick Robinson (nickrobinson)]

Summary

• Security fix (react-native): qs override bumped from 6.14.2 → 6.15.2 to close GHSA-q8mj-m7cp-5q26 — a remotely-triggerable DoS via qs.stringify when encodeValuesOnly is set and the input array contains null/undefined entries. The prior override pinned a version inside the vulnerable range (6.11.1–6.15.1).
• Security fix (react-native): body-parser override added at 1.20.5 to close a moderate vulnerability affecting 1.20.3–1.20.4. This is a transitive dep via @react-native-community/cli.
• Lock file updates (all JS apps): npm update applied across electron, javascript-tui, javascript-web, react-native, and react-native-expo to pull in all latest patch/minor releases within existing semver ranges. No package.json version constraints were changed for these.
• react-native/yarn.lock and react-native-expo/package-lock.json updated alongside their npm counterparts per repo convention.

Dependency audit results

App	Before	After
javascript-web	0 vulnerabilities	0 vulnerabilities
javascript-tui	0 vulnerabilities	0 vulnerabilities
electron	0 vulnerabilities	0 vulnerabilities
react-native	4 moderate (qs, body-parser, cli)	0 vulnerabilities
react-native-expo	11 moderate (uuid via expo)	11 moderate (see below)

MANUAL INTERVENTION REQUIRED

react-native-expo — uuid GHSA-w5hq-g745-h8pq (moderate)

• Alert: uuid < 11.1.1 — missing buffer bounds check in v3/v5/v6 when buf is provided.
• Root chain: expo → @expo/cli → @expo/config-plugins → xcode → uuid ^7.0.3
• What was tried: npm audit fix — the tool's suggested fix is to downgrade expo from 55.x to 46.0.21, which is a 9-major-version regression and clearly incorrect. Adding a uuid: ">=11.1.1" resolution was not applied because xcode declares uuid: "^7.0.3" and the uuid v8+ API changed (removed UMD/CommonJS default export); forcing v11 risks breaking xcode internals without a live build to verify against.
• Suggested fix: Upgrade react-native-expo to Expo SDK 56 (expo@~56.0.0), which ships a newer @expo/config-plugins that depends on a patched xcode. This is a coordinated SDK upgrade that should be done as a separate PR after verifying native builds.

Test plan

• npm audit in react-native → 0 vulnerabilities
• npm audit in javascript-web, javascript-tui, electron → 0 vulnerabilities each
• Verify react-native app builds: react-native build-android / react-native build-ios
• Verify electron app builds: npm run build
• Verify javascript-web builds: npm run build

https://claude.ai/code/session_01PZM7zLyuuXX1BFpzZtpn5P

---

Generated by Claude Code

[Copilot]

Pull request overview

Applies security-driven dependency updates to the JS apps in the repo. The react-native app gets explicit overrides to patch a qs DoS vulnerability and a body-parser advisory, while lock files across electron, javascript-tui, javascript-web, react-native, and react-native-expo are refreshed via npm update / yarn within existing semver ranges. The PR description notes the react-native-expo uuid transitive vulnerability is deferred to a future SDK upgrade.

Changes:

• Bump qs override from 6.14.2 → 6.15.2 (GHSA-q8mj-m7cp-5q26) and add body-parser 1.20.5 override in react-native/package.json.
• Refresh transitive deps in react-native/yarn.lock to match the new overrides (also downgrades iconv-lite, type-is, raw-body, etc. as a side effect).
• Routine minor/patch lockfile updates in electron/package-lock.json and javascript-tui/package-lock.json (Babel 7.29.7, semver dedupe, rollup 4.61.0, swc 1.15.40, typescript-eslint 8.60.0, etc.).

Reviewed changes

Copilot reviewed 1 out of 7 changed files in this pull request and generated 1 comment.

File	Description
react-native/package.json	Adds body-parser@1.20.5 override and bumps qs to 6.15.2 in both overrides and resolutions.
react-native/yarn.lock	Reflects the new overrides; pins body-parser and its old-style deps to 1.x equivalents.
javascript-tui/package-lock.json	Routine npm-update refresh (Babel 7.29.7, js-yaml 4.2.0, hasown 2.0.4, etc.).
electron/package-lock.json	Routine npm-update refresh (electron 42.3.0, rollup 4.61.0, swc 1.15.40, typescript-eslint 8.60.0).

Files not reviewed (1)

• electron/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Kristopher Johnson (kristopherjohnson)]

Closing this because we are moving quickstart code to the monorepo.