[mattinannt]

Summary

Resolves the high and critical Dependabot alerts that have a safely applicable patched release, by bumping pnpm.overrides (all transitive, via Expo/Metro/React Native tooling in apps/playground and rimraf):

Package	Severity	From	To
shell-quote	critical (GHSA-pqg4-j6r4-53mv)	1.10.0	1.12.0
brace-expansion@1	high (GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p)	1.1.18	1.1.21
brace-expansion@5	high (same advisories)	5.0.9	5.0.12
compression	high (GHSA-vc2v-76pw-4v95)	1.8.1	1.8.2
source-map-js	high (GHSA-68fv-2mgg-jv7q)	1.2.1	1.2.2

Still open

• image-size 1.2.1 (high, GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr): the fix is only in 2.x, which is incompatible with Metro 0.83.3 (getAssetData passes a file path; v2 accepts only a Uint8Array). Metro 0.83.8 dropped image-size, but @expo/metro pins 0.83.3, so this needs an Expo/Metro bump rather than an override.
• node-forge 1.4.0 (high, GHSA-86w9-cpqp-85rv) and braces 3.0.3 (high, GHSA-vfj7-8cjw-p6xm): no patched release exists upstream.

Verification

• pnpm install (lockfile regenerated), pnpm lint, pnpm check-types, pnpm test, pnpm build: all pass
• pnpm audit: no critical left; remaining high are the three packages above

🤖 Generated with Claude Code

https://claude.ai/code/session_01D3Ba7ExS8d1j3xFXvJXNn1