From eb7040107da281456d41dddbd65be3948f635388 Mon Sep 17 00:00:00 2001 From: Allan Juma Date: Fri, 14 Aug 2026 18:47:13 +0300 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=94=90=20deps:=20upgrade=20turbo=20to?= =?UTF-8?q?=202.x=20so=20its=20two=20advisories=20are=20fixed,=20not=20def?= =?UTF-8?q?erred?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit turbo 1.13.4 carried GHSA-3qcw-2rhx-2726 and GHSA-hcf7-66rw-9f5r, allowlisted until November because the fix is a major. Upgrading to 2.10.10 resolves both, so the two entries come out of osv-scanner.toml rather than being re-dated. turbo 2 renames turbo.json's top-level pipeline key to tasks; the official codemod confirms that rename is the only change this config needs. CI parses turbo's --dry=json output to read a task's cache status, so that contract was checked explicitly against both build tasks and still holds. --- osv-scanner.toml | 10 ---- package.json | 2 +- turbo.json | 2 +- yarn.lock | 120 +++++++++++++++++++++++------------------------ 4 files changed, 62 insertions(+), 72 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 5c69e2cb..79d9904b 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -87,13 +87,3 @@ reason = "tmp 0.0.33 via external-editor and patch-package. Fix is 0.2.x, and a id = "GHSA-ph9p-34f9-6g65" ignoreUntil = 2026-11-14 reason = "tmp 0.0.33 via external-editor and patch-package. Fix is 0.2.x, outside the ^0.0.33 range. Dev-only." - -[[IgnoredVulns]] -id = "GHSA-3qcw-2rhx-2726" -ignoreUntil = 2026-11-14 -reason = "turbo 1.13.4, a direct devDependency pinned ^1.10.7. Fix is 2.x, which changes turbo.json's schema (pipeline -> tasks), so it needs its own change. Build-time only." - -[[IgnoredVulns]] -id = "GHSA-hcf7-66rw-9f5r" -ignoreUntil = 2026-11-14 -reason = "turbo 1.13.4, a direct devDependency pinned ^1.10.7. Fix is 2.x, a schema-changing major. Build-time only." diff --git a/package.json b/package.json index cae8f98c..2347c7c5 100644 --- a/package.json +++ b/package.json @@ -67,7 +67,7 @@ "react-native": "0.74.2", "react-native-builder-bob": "^0.20.0", "release-it": "^15.0.0", - "turbo": "^1.10.7", + "turbo": "^2.10.10", "typescript": "^5.2.2" }, "resolutions": { diff --git a/turbo.json b/turbo.json index 331e2890..b7e00bb5 100644 --- a/turbo.json +++ b/turbo.json @@ -1,6 +1,6 @@ { "$schema": "https://turbo.build/schema.json", - "pipeline": { + "tasks": { "build:android": { "inputs": [ "package.json", diff --git a/yarn.lock b/yarn.lock index 46f33081..88cf6d89 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3425,7 +3425,7 @@ __metadata: react-native: 0.74.2 react-native-builder-bob: ^0.20.0 release-it: ^15.0.0 - turbo: ^1.10.7 + turbo: ^2.10.10 typescript: ^5.2.2 peerDependencies: react: "*" @@ -3470,6 +3470,48 @@ __metadata: languageName: node linkType: hard +"@turbo/darwin-64@npm:2.10.10": + version: 2.10.10 + resolution: "@turbo/darwin-64@npm:2.10.10" + conditions: os=darwin & cpu=x64 + languageName: node + linkType: hard + +"@turbo/darwin-arm64@npm:2.10.10": + version: 2.10.10 + resolution: "@turbo/darwin-arm64@npm:2.10.10" + conditions: os=darwin & cpu=arm64 + languageName: node + linkType: hard + +"@turbo/linux-64@npm:2.10.10": + version: 2.10.10 + resolution: "@turbo/linux-64@npm:2.10.10" + conditions: (os=android | os=linux) & cpu=x64 + languageName: node + linkType: hard + +"@turbo/linux-arm64@npm:2.10.10": + version: 2.10.10 + resolution: "@turbo/linux-arm64@npm:2.10.10" + conditions: (os=android | os=linux) & cpu=arm64 + languageName: node + linkType: hard + +"@turbo/windows-64@npm:2.10.10": + version: 2.10.10 + resolution: "@turbo/windows-64@npm:2.10.10" + conditions: os=win32 & cpu=x64 + languageName: node + linkType: hard + +"@turbo/windows-arm64@npm:2.10.10": + version: 2.10.10 + resolution: "@turbo/windows-arm64@npm:2.10.10" + conditions: os=win32 & cpu=arm64 + languageName: node + linkType: hard + "@types/babel__core@npm:^7.1.14": version: 7.20.5 resolution: "@types/babel__core@npm:7.20.5" @@ -13238,74 +13280,32 @@ __metadata: languageName: node linkType: hard -"turbo-darwin-64@npm:1.13.4": - version: 1.13.4 - resolution: "turbo-darwin-64@npm:1.13.4" - conditions: os=darwin & cpu=x64 - languageName: node - linkType: hard - -"turbo-darwin-arm64@npm:1.13.4": - version: 1.13.4 - resolution: "turbo-darwin-arm64@npm:1.13.4" - conditions: os=darwin & cpu=arm64 - languageName: node - linkType: hard - -"turbo-linux-64@npm:1.13.4": - version: 1.13.4 - resolution: "turbo-linux-64@npm:1.13.4" - conditions: os=linux & cpu=x64 - languageName: node - linkType: hard - -"turbo-linux-arm64@npm:1.13.4": - version: 1.13.4 - resolution: "turbo-linux-arm64@npm:1.13.4" - conditions: os=linux & cpu=arm64 - languageName: node - linkType: hard - -"turbo-windows-64@npm:1.13.4": - version: 1.13.4 - resolution: "turbo-windows-64@npm:1.13.4" - conditions: os=win32 & cpu=x64 - languageName: node - linkType: hard - -"turbo-windows-arm64@npm:1.13.4": - version: 1.13.4 - resolution: "turbo-windows-arm64@npm:1.13.4" - conditions: os=win32 & cpu=arm64 - languageName: node - linkType: hard - -"turbo@npm:^1.10.7": - version: 1.13.4 - resolution: "turbo@npm:1.13.4" - dependencies: - turbo-darwin-64: 1.13.4 - turbo-darwin-arm64: 1.13.4 - turbo-linux-64: 1.13.4 - turbo-linux-arm64: 1.13.4 - turbo-windows-64: 1.13.4 - turbo-windows-arm64: 1.13.4 +"turbo@npm:^2.10.10": + version: 2.10.10 + resolution: "turbo@npm:2.10.10" + dependencies: + "@turbo/darwin-64": 2.10.10 + "@turbo/darwin-arm64": 2.10.10 + "@turbo/linux-64": 2.10.10 + "@turbo/linux-arm64": 2.10.10 + "@turbo/windows-64": 2.10.10 + "@turbo/windows-arm64": 2.10.10 dependenciesMeta: - turbo-darwin-64: + "@turbo/darwin-64": optional: true - turbo-darwin-arm64: + "@turbo/darwin-arm64": optional: true - turbo-linux-64: + "@turbo/linux-64": optional: true - turbo-linux-arm64: + "@turbo/linux-arm64": optional: true - turbo-windows-64: + "@turbo/windows-64": optional: true - turbo-windows-arm64: + "@turbo/windows-arm64": optional: true bin: turbo: bin/turbo - checksum: 94533f700dbbb7b556a7152ef04500a44b571232daf1eb9bd82bcfebac473d0cf45a78c851325c6867246656cb0b3be7c62a412381b6e85c77c1eddf51302778 + checksum: bfb31a042af20cf8219aef7054dd273434a5357e9f1520c0d704146d719bb7383726c25bf8fb7dcb6d12d9c1937e9efbe909cb913c1ce9892a34d65004ef610b languageName: node linkType: hard From 0368cf55a9a8b9e6f226084fdbe3200b606fb29b Mon Sep 17 00:00:00 2001 From: Allan Juma Date: Fri, 14 Aug 2026 18:57:58 +0300 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=90=9B=20ci(turbo):=20restore=20env?= =?UTF-8?q?=20passthrough=20so=20the=20native=20builds=20find=20the=20SDK?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit turbo 2 defaults envMode to strict, which passes task processes only the variables declared in env/globalEnv/passThroughEnv. The gradle build therefore lost ANDROID_HOME and failed with 'SDK location not found', which is how build-android went red on the previous commit. envMode: loose restores turbo 1's behaviour — every variable reaches the task — so the ambient toolchain paths the native builds depend on (ANDROID_HOME, JAVA_HOME, DEVELOPER_DIR) are available again. Declaring each one in passThroughEnv would be tighter, but it trades a known-good configuration for a list that is easy to leave a hole in; worth doing separately, with someone watching the first runs. --- turbo.json | 1 + 1 file changed, 1 insertion(+) diff --git a/turbo.json b/turbo.json index b7e00bb5..abb45712 100644 --- a/turbo.json +++ b/turbo.json @@ -1,5 +1,6 @@ { "$schema": "https://turbo.build/schema.json", + "envMode": "loose", "tasks": { "build:android": { "inputs": [ From c780ce14e4e7787647c178486883e25068cdbeec Mon Sep 17 00:00:00 2001 From: Allan Juma Date: Wed, 2 Sep 2026 16:35:12 +0300 Subject: [PATCH 3/3] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20deps:=20refresh=20t?= =?UTF-8?q?he=20three=20transitive=20packages=20OSV=20started=20flagging?= =?UTF-8?q?=20after=20the=20August=20triage?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vm2 3.11.5 (via release-it → proxy-agent → degenerator), browserslist 4.25.1 (via Babel) and decode-uri-component 0.2.2 (via @react-navigation/core → query-string) picked up eight advisories since osv-scanner.toml was re-triaged on 2026-08-14, and the audit has been red on main since 2026-08-31. All three are dev-only and reachable by a lockfile refresh, which the allowlist's own rule says to prefer over listing them: vm2 and browserslist move within their parents' ranges (3.12.0, 4.28.8); decode-uri-component's fix is outside query-string's ^0.2.2, so it is pinned through resolutions like fast-xml-parser already is. yarn lint, typecheck, test and prepare pass. --- package.json | 1 + yarn.lock | 72 ++++++++++++++++++++++++++++++---------------------- 2 files changed, 42 insertions(+), 31 deletions(-) diff --git a/package.json b/package.json index 2347c7c5..4dbbd97d 100644 --- a/package.json +++ b/package.json @@ -72,6 +72,7 @@ }, "resolutions": { "@types/react": "^18.2.44", + "decode-uri-component": "^0.5.0", "fast-xml-parser": "^5.7.0" }, "peerDependencies": { diff --git a/yarn.lock b/yarn.lock index 88cf6d89..fb7274b6 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4498,6 +4498,15 @@ __metadata: languageName: node linkType: hard +"baseline-browser-mapping@npm:^2.11.12": + version: 2.11.20 + resolution: "baseline-browser-mapping@npm:2.11.20" + bin: + baseline-browser-mapping: dist/cli.cjs + checksum: 57304eb3e402e6ee43836dc5695d0680db1381054ee25dd02dc703eeac9b760f6bb5e3e94ab4a1d09cffa44eac3e56fda10bfa5364a951256149fd55b62f4df1 + languageName: node + linkType: hard + "basic-ftp@npm:^5.0.2": version: 5.3.1 resolution: "basic-ftp@npm:5.3.1" @@ -4595,16 +4604,17 @@ __metadata: linkType: hard "browserslist@npm:^4.20.4, browserslist@npm:^4.24.0, browserslist@npm:^4.25.1": - version: 4.25.1 - resolution: "browserslist@npm:4.25.1" - dependencies: - caniuse-lite: ^1.0.30001726 - electron-to-chromium: ^1.5.173 - node-releases: ^2.0.19 - update-browserslist-db: ^1.1.3 + version: 4.28.8 + resolution: "browserslist@npm:4.28.8" + dependencies: + baseline-browser-mapping: ^2.11.12 + caniuse-lite: ^1.0.30001809 + electron-to-chromium: ^1.5.402 + node-releases: ^2.0.53 + update-browserslist-db: ^1.3.0 bin: browserslist: cli.js - checksum: 2a7e4317e809b09a436456221a1fcb8ccbd101bada187ed217f7a07a9e42ced822c7c86a0a4333d7d1b4e6e0c859d201732ffff1585d6bcacd8d226f6ddce7e3 + checksum: cf6e9dd104a26ba88c2a56d319f7f659c4ee1384960f601331cfb75bb05826033245587026a25903d4745cbaac251203dcfc6e3a869e60f359686138bd551554 languageName: node linkType: hard @@ -4810,10 +4820,10 @@ __metadata: languageName: node linkType: hard -"caniuse-lite@npm:^1.0.30001726": - version: 1.0.30001731 - resolution: "caniuse-lite@npm:1.0.30001731" - checksum: ecd2ad779f31011bef657c0104a08a780d9bb38ff8ad7aeeeaf196151be22c492de87f4a9c89a30ea4aa9575c5a39c85bf6bd56e89a4bf8259f54a4fbfc24a0d +"caniuse-lite@npm:^1.0.30001809": + version: 1.0.30001810 + resolution: "caniuse-lite@npm:1.0.30001810" + checksum: 4ff2dae8df59eb5f5ae71c4803666cf581459a9432c7cf016afd85f4f110774fb9c6469a62ff69a73ed7be5a7eae27988656c3acf56bceed7b0f24358426a5a8 languageName: node linkType: hard @@ -5665,10 +5675,10 @@ __metadata: languageName: node linkType: hard -"decode-uri-component@npm:^0.2.2": - version: 0.2.2 - resolution: "decode-uri-component@npm:0.2.2" - checksum: 95476a7d28f267292ce745eac3524a9079058bbb35767b76e3ee87d42e34cd0275d2eb19d9d08c3e167f97556e8a2872747f5e65cbebcac8b0c98d83e285f139 +"decode-uri-component@npm:^0.5.0": + version: 0.5.0 + resolution: "decode-uri-component@npm:0.5.0" + checksum: b5ea6417714cf2da39a4e59095a9572fe3a47aab08abbbe08a330ba11a96d937d3948565e5739fb9c7f48f278222e69a4e4e6356eb6f7b88643eba264f1d07b8 languageName: node linkType: hard @@ -5964,10 +5974,10 @@ __metadata: languageName: node linkType: hard -"electron-to-chromium@npm:^1.5.173": - version: 1.5.195 - resolution: "electron-to-chromium@npm:1.5.195" - checksum: 8002cb96a6ce87e6c64a3b5c3f71bb852a41a232312151b5c057f79c75aee76c948468bfabf0cd5aab082d28c39c6a4e0dce2b7d479a29ba2016a2e024796dba +"electron-to-chromium@npm:^1.5.402": + version: 1.5.420 + resolution: "electron-to-chromium@npm:1.5.420" + checksum: 95e7380d639da34f75b2964f64579042bd8b15847f4582eff19f0520fc5919605a2bdd7b3359c04ad9f8019573dc3374efb3b91ea1b85855876654da93d3ca63 languageName: node linkType: hard @@ -10477,10 +10487,10 @@ __metadata: languageName: node linkType: hard -"node-releases@npm:^2.0.19": - version: 2.0.19 - resolution: "node-releases@npm:2.0.19" - checksum: 917dbced519f48c6289a44830a0ca6dc944c3ee9243c468ebd8515a41c97c8b2c256edb7f3f750416bc37952cc9608684e6483c7b6c6f39f6bd8d86c52cfe658 +"node-releases@npm:^2.0.53": + version: 2.0.54 + resolution: "node-releases@npm:2.0.54" + checksum: 34dd32cb489b71306e25014ccc5ddd2a1793ba13aed75dcbb6f7ec144fa093030cb91781d1d296fb7105987f42f23d3877a1ec0913702be4412f2493fdfe3102 languageName: node linkType: hard @@ -13614,9 +13624,9 @@ __metadata: languageName: node linkType: hard -"update-browserslist-db@npm:^1.1.3": - version: 1.1.3 - resolution: "update-browserslist-db@npm:1.1.3" +"update-browserslist-db@npm:^1.3.0": + version: 1.3.2 + resolution: "update-browserslist-db@npm:1.3.2" dependencies: escalade: ^3.2.0 picocolors: ^1.1.1 @@ -13624,7 +13634,7 @@ __metadata: browserslist: ">= 4.21.0" bin: update-browserslist-db: cli.js - checksum: 7b6d8d08c34af25ee435bccac542bedcb9e57c710f3c42421615631a80aa6dd28b0a81c9d2afbef53799d482fb41453f714b8a7a0a8003e3b4ec8fb1abb819af + checksum: 68b13d54c6da73d22fe36820ed3d32226811b3837386ec9cf2cf866d3c958fc5522946c20123867456cc199dcb952103a1d2a26d6b3b6eb47a317551ea24ea72 languageName: node linkType: hard @@ -13732,14 +13742,14 @@ __metadata: linkType: hard "vm2@npm:^3.9.19": - version: 3.11.5 - resolution: "vm2@npm:3.11.5" + version: 3.12.0 + resolution: "vm2@npm:3.12.0" dependencies: acorn: ^8.15.0 acorn-walk: ^8.3.4 bin: vm2: bin/vm2 - checksum: f45b09f28df96696bb5869b0c0e9acf0a91d9dbc27c0e64b0e500480c6de33d92d645bd5b2bc56a9466ee4b8f856d02eb45d1b165d4b957cc7e5f10d9dccdc77 + checksum: 2b107fb79361fded3403afa32b32e6a15d9c281bd505ef1cc695dbcac36c28ce7c3f840b1eeb0980537695be6cae3173190f53df27392b3f498bdf7eaa235c7f languageName: node linkType: hard