Repository navigation
Resolve High advisories in React Native development dependencies #312
Description
Problem
The complete React Native audit identifies two High advisories in development tooling.
The four Medium lockfile findings remain tracked in #311.
Evidence
Source: dev 2c5ae52dbf8c7e814777bc0d1a05ddbfe298ab9e.
Complete baseline and candidate audits contain the same two High records.
Neither audit used exclusions or suppression.
braces3.0.3 arrives throughmicromatch4.0.8.- GHSA-vfj7-8cjw-p6xm lists
<=3.0.3and has no first patched version. - The official npm registry still lists braces 3.0.3 as latest.
- The open maintainer issue is Security Advisory: Uncontrolled Recursion Depth in Tree Walkers Leads to Stack-Overflow DoS micromatch/braces#70.
http-cache-semantics4.2.0 arrives throughmake-fetch-happen15.0.4.- GHSA-ch52-4w7c-c8xp lists
<=4.2.0. - Version 4.3.0 satisfies the unchanged parent range
^4.1.1.
The cache maintainer disputes the advisory in kornelski/http-cache-semantics#56 (comment).
Issue #32 already corrected the documentation lockfile to 4.3.0.
That correction does not change the separate React Native lockfile.
Clearing a listed version range does not establish a behavioral repair for the disputed claim.
Retained audit records: synchro_311_baseline-audit.stdout and synchro_311_candidate-audit.stdout under /private/tmp/trainstar-s18-20261002.
Runtime exploitability is not established.
The stream-json record already has measured consumer applicability evidence and a verified disposition in closed issue #86.
Do not force its incompatible transitive major or reopen that finding without changed consumer evidence.
Five deprecation records, three unmet peers, and nine lint warnings remain disclosed in the current gate evidence.
Fix shape
Update the compatible cache leaf without changing its parent range.
Investigate exact braces consumers before selecting an applicability or dependency correction.
Do not invent an unavailable patched release or add an unsupported override.
Preserve all existing assertions and complete audit output.
Acceptance
- Record exact consumer paths and authoritative advisory applicability.
- Verify each compatible correction with a clean immutable install, complete audit, JavaScript, package, and affected tooling gates.
- Independently review the complete diff and runtime evidence.
- Resolve each High finding with measured correction or authoritative non-applicability evidence.
- Integrate the reviewed correction on dev.
Severity: High, from the two named audit and authoritative advisory records.
This finding does not establish an app #75 cause.
Activity
mdspinali commentedon Oct 5, 2026
Cache correction merged through #314 in
d5253beea3a543c0f9fa8a4722d935df88882b5e.Only http-cache-semantics changes from 4.2.0 to 4.3.0 within its unchanged parent range.
Independent source and runtime review accepted the exact correction.
Clean committed Make checks, 239 unit tests, package preparation, package structure, and contracts passed.
Every required PR check passed on 76a5dc2.
The merged tree matches the reviewed PR tree.
The complete transitive audit changes from eight records to seven.
Only GHSA-ch52-4w7c-c8xp disappears. All remaining records and peer output match exactly.
Both audits still exit one. Three unmet peers, five deprecations, and nine lint warnings remain disclosed.
The maintainer disputes the cache advisory. Clearing its version range does not prove a behavioral repair.
The separate braces finding remains open.
Root retained exact installed consumer sources and is tracing actual pattern inputs before the runtime applicability decision.
No advisory suppression, forced major override, issue closure, or release promotion applies.
Artifacts: synchro_312 records under /private/tmp/trainstar-s18-20261002.
mdspinali commentedon Oct 6, 2026
Change
The Braces finding remains unresolved. Independent review does not support closure.
The accepted cache correction remains complete.
Validation
<=3.0.3and no patched version.3.0.3as latest.3.0.3, Micromatch4.0.8, Fast-glob3.3.3, and CLI Android configuration20.2.0.RangeError. The harness assigned exit code2.22.22.0, a 64 MiB heap limit, and a five-second timeout. No probe timed out.The Android finder interpolates
codegenConfig.jsSrcsDirinto a glob without escaping or a nesting limit.The retained finder source is
@react-native-community/cli-config-android@20.2.0/build/config/findComponentDescriptors.js:37.Fast-glob passes this pattern to
micromatch.braceswithexpand: true.Native-package guards run before the finder at
build/config/index.js:102.The controlled package fixture contains only
package.jsonand calls the finder directly.This proof does not establish passage through the native guards or an uncaught full-command failure.
Android Gradle and CocoaPods routes invoke community CLI configuration without a platform restriction.
Apple automatic Pods processing evaluates dependency configuration before its cache decision.
These routes have source evidence. They have no complete command reproduction.
Developer-supplied clean arguments also reach Fast-glob through Meow, Del, and Globby.
The package inventory contains 84 files and no bundled dependencies.
That inventory does not establish non-applicability for development tools or consumer installations.
No application-runtime attack path is established.
Evidence remains in
/private/tmp/trainstar-s18-20261002:synchro_312_current_advisory.json,synchro_312_current_registry.json, andsynchro_312_braces_actual_probe_v2.json.The complete source manifests and probe outputs remain retained.
The review brief is
docs/agent-tasks/2026-10-05-synchro-braces-applicability-review.mdin the API worktree.Closure requires a supported dependency correction with validation, or authoritative non-applicability for the complete supported input boundary.
Preserve the advisory High classification without claiming measured production exploitability.
This upstream development dependency does not prevent independent API stages.
mdspinali commentedon Oct 7, 2026
The complete RN Candidate consumer audits confirm the unresolved Braces finding on clean source
0c0279863507183c4e72386db9a4adc4f66933a5.Both retained original Candidate lock copies were audited without exclusions.
Both
npm audit --jsoncommands returned 1.Each reports 52 package records from two unique advisories.
Braces contributes one concrete High advisory and 46 inherited High records.
Sprintf-js contributes one concrete Moderate advisory and four inherited Moderate records, now tracked in #328.
Current official evidence still lists Braces 3.0.3 as latest and no patched version for GHSA-vfj7-8cjw-p6xm.
Neither audit contains a concrete http-cache-semantics advisory.
The completed cache correction remains unchanged.
No forced major, override, suppression, or dependency change ran.
The new lifecycle logs have the same totals.
Their deleted consumer locks prevent exact historical advisory identity comparison.
The reproduced locks belong to the retained full Candidate upgrade consumers.
Equal counts do not prove identical dependency bytes.
The nine local lifecycle executions passed their functional checks.
That result does not clear this security finding or authorize publication.
Braces remains open. Complete supported-input non-applicability remains unproved.
The existing dependency workflow still uses its unchanged
ignore-unfixed: truesetting.A passing workflow under that policy does not clear the complete npm audit.
Evidence:
diagnose-rn-consumer-npm-advisories-0c02-report.md, its JSON index, and the complete audit files.RN82 audit SHA-256:
43471eb532c73ac97d1201e0a7406eafe7d28c25e7ec99b3972e8e6649cc22b8.RN83 audit SHA-256:
98973864ff08c37c644a2611bc6edc214e98687c1fc0459ca162edbd93f2d067.mdspinali commentedon Oct 9, 2026
Current audit source: clean
e6b8e35c889e6d30b6750395beebc92b448bf1d4.yarn npm audit --all --recursive --jsonreturned exit1inclients/react-native.The complete output remains at
/private/tmp/synchro-rn082-final-rn-audit.jsonl.No advisory exclusions or audit suppression were used.
The audit still reports the
bracesfinding in #312.It also reports the
compressionandshell-quotefindings in #329.The
sprintf-jsandstream-jsonfindings remain associated with #328 and #330.The audit now reports three additional
handlebarsrecords throughts-jest29.4.6:The selected package is
handlebars4.7.9.These records require a supported dependency correction or measured applicability review.
The audit does not establish mobile application or sync-service exploitability.
The RN and fmt replacement does not include the canceled broader dependency corrections.
Passing source-quality and compatibility commands do not resolve these security findings.
Keep publication blocked until the applicable findings have accepted evidence.
mdspinali commentedon Oct 9, 2026
Source:
ad2ab01831172595b39a74203a8fa75a246c9140.The full installed React Native CLI reproduces the Braces failure.
The runtime chain is CLI Android configuration 20.2.0, Fast-glob 3.3.3, Micromatch 4.0.8, and Braces 3.0.3.
The fixture passes the normal native dependency guards.
Only dependency metadata
codegenConfig.jsSrcsDirchanges between runs.RangeErrorand exit one.braces/lib/expand.js:103.The failure requires native-package metadata or equivalent configuration control.
The probe does not demonstrate an application-network input path or mobile runtime exploitation.
The 145 recorded source-file hashes match after execution. This count describes inspected files, not independent consumers.
Independent security review rejects complete-scope non-applicability.
Immutable installs establish repeatability. They do not remove the demonstrated configuration path.
A runtime-only exclusion does not resolve development-tool applicability.
A scanner configured with
ignore-unfixedcannot close this issue.The authoritative advisory still provides no patched Braces version:
GHSA-vfj7-8cjw-p6xm
The issue remains blocked on a verified correction or complete-scope applicability evidence.
No dependency override, audit suppression, or unavailable version was added.
Retained evidence root:
/var/folders/y8/wy98kv8j67g9bmkz49xmrt_80000gn/T/opencode/synchro-312-cli-config-wd0EvF/.The root contains replay inputs, all three attempts, source hashes, traces, structured results, and
summary.json.Review:
/private/tmp/synchro-rn082-braces-security-astra-review.jsonl.mdspinali commentedon Oct 11, 2026
Current closeout status
Current dev remains clean at
538e1bf7d302d098d33659cb507a2489de761159.The complete recursive audit still reports the Braces finding.
No scanner exclusion or risk exception was applied.
The official registry still selects Braces 3.0.3 as latest.
Latest Micromatch 4.0.8 still requires Braces ^3.0.3.
The authoritative GHSA-vfj7-8cjw-p6xm record lists <=3.0.3 and no patched version.
The advisory record was updated on October 2, 2026.
Fresh registry metadata and the complete advisory response remain retained in the closeout records.
The measured real-CLI failure in comment 6088522585 remains unresolved.
That record includes benign and missing-directory controls, source identities, bounded execution, and independent security review.
Successful installs or the configured ignore-unfixed scan do not resolve this finding.
The compatible cache correction remains integrated separately.
The release request permits no unresolved issue at publication.
This issue therefore remains open until a verified correction or complete applicability disposition satisfies its acceptance criteria.
mdspinali commentedon Oct 12, 2026
Selected compatible repair
The user renewed the request to complete all repairs and publication.
The repair will preserve package versions, parent ranges, and full audit output.
For #312, the CLI will escape the documented jsSrcsDir directory before appending its fixed source-extension glob.
The installed Fast-glob convertPathToPattern API provides the required literal-path behavior.
The correction changes the concrete directory-to-pattern boundary that reproduced the defect.
It preserves traversal, file reads, exclusions, and duplicate handling.
The overlength invalid directory still encounters a bounded existing input-length error.
That measured error is SyntaxError, not RangeError.
No new depth cap, blanket error suppression, or fabricated empty result will be added.
Literal special-character directories and neighboring decoys will provide semantic proof.
The same proof must fail when escaping is removed.
The remaining supported Braces consumer inputs still require source-flow classification before closure.
For #330, the repair will backport the property-write logic from upstream commit 2f2d35bbb547306991ded6487a279154d865a358.
Both Assembler 1.9.1 write paths will create own proto data properties with native JSON property attributes.
Other assignments, reviver invocation, arrays, and public API behavior will remain unchanged.
The actual trace merger must preserve correct thread remapping and event order.
Normal and reviver controls must reject omission of either corrected assignment.
The JSONC non-applicability disposition remains separate.
Each correction will have one canonical, version-bound patch asset.
Yarn workspaces will use the supported patch protocol.
Published package assets and an explicit setup command will deliver the same correction to npm consumers.
Both public and prepublication consumer paths must use the delivered patch before affected commands.
Version, source preimage, postimage, and patch identities must be checked.
Fresh installation must not restore unpatched bytes without detection.
Independent design review accepts the narrow source-correction shapes.
The primary selects path escaping because it preserves existing discovery behavior with the smallest change.
Changing traversal cwd would require additional absolute-path and exclusion decisions.
Implementation, independent final review, and applicable Make gates remain required.
No issue closes from this proposed design, and no security exception is authorized.
mdspinali commentedon Oct 12, 2026
The proposed corrections are in draft PR #337.
The review identified two additional literal path sources for Braces expansion:
os.tmpdir().The CLI correction escapes the directory prefix before the existing cache patterns.
Bob uses literal removal. Independent review found that the first Bob correction removed Del's deletion-ownership protection.
The ownership correction is in progress. Protected-directory regression cases demonstrate the lost boundary.
This issue remains open.
Retained failures:
1a2a96f11841c8fd6abe2249021865079ed5889aduring reverse application of the Bob delivery patch.b5282ecf4eff6d0db584deb757153467cc0d3accreplaces those hunks with standard unified contexts.1a2a96f11841c8fd6abe2249021865079ed5889a.The audit still reports upstream version advisories. The corrections do not change version numbers or suppress audit records.
Final acceptance requires the actual corrected source, complete validation, independent review, package delivery evidence, and integration into dev.
mdspinali commentedon Oct 12, 2026
Fixed in
e1423464c28db134e1b388549d9be6951ba777e7through #337.Change
The correction removes ordinary directory data from Braces pattern expansion.
codegenConfig.jsSrcsDirbefore its fixed source pattern.os.tmpdir()before its authored cache suffix patterns.The reviewed remaining consumers use authored pattern configuration or matcher subjects.
Android and Apple directory finders use literal
cwdwith fixed patterns.Metro workspace entries remain explicit authored workspace patterns.
This disposition covers the actual SDK tooling consumers. It does not certify arbitrary third-party glob programs.
Canonical version-bound patches appear in
clients/react-native/tooling-patches/.Yarn uses those patches without changing parent versions or ranges.
The built npm package carries the same assets and the explicit verified setup command.
Both public and prepublication consumer branches run CLI setup before affected tooling.
The compatible
http-cache-semantics4.3.0 correction remains integrated through #314.Its independent source, runtime, and immutable-install evidence remains in the earlier comment.
The maintainer disputes that advisory. The version change is not presented as proof of runtime exploitability.
Validation
Clean source:
83a5d05ebe0f3ca6baa454285f466c7b202e526b.make test-rn-tooling-security: four tests pass on macOS and Linux, with zero failures or skips.make test-rn-tooling-package: the exact packaged test passes on both hosts, with zero failures or skips.0ed190932fb232e2905d252abf5720cb26e62a44produces the intended semantic failure.5e780e4528fa8cb89a484d1988466d881da40474fails because Bob removes protected project data.41ce71da69b2e4a025744656dc3b0c7f645081a4.The reviewed source, checked merge, and integrated dev commit have tree
948384ec557d7921f6678e7587673b93fea8abcf.The complete recursive Yarn audit on clean
1b7922d00f87792406e92db836e123699f62b2a2still exits 1 without exclusions.Its audit inputs are unchanged at the final source. Upstream version advisories remain visible.
The correction changes measured consumer behavior. It does not invent a patched upstream Braces version or suppress an advisory.
Earlier GNU patch, ownership, and proof-integrity failures remain recorded.
The parallel macOS run affected by source changes remains diagnostic evidence only.
Release Candidate and sealed Package checks remain separate required publication conditions.