[Snyk] Fix for 2 vulnerabilities

[ashley-lizbeth]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • apps/expo/package.json
  • apps/expo/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: expo

The new version differs by 250 commits.

• 2975b6d Publish packages
• 7995f30 Publish packages
• 2b6c5cb [docs] Fix Image blurhash syntax in placeholder prop
• a5cd2f4 [template] Add privacy_file_aggregation_enabled to the correct place
• 4d8aaab [template] Add missing comma
• 14ff547 [packages] Commit build files
• 9a1f53f [build-properties] Add field to enable/disable privacy manifest aggregation (#28646)
• 19f4c9a chore(cli): bump canary to support React 19 beta (#28592)
• 6d629fd feature(expo-build-properties): add `ios.ccacheEnabled` option to enable c++ compiler cache (#28638)
• 87efd0c Add additional config flag to allow forcing RTL on LTR locales (#28129)
• 9c8b6d4 [core][Android] Remove Kotlin warnings (#28629)
• 9782fb3 [core][Android] Add the method name to unexpected exception (#28626)
• 338477c [video][Android] Remove Kotlin warnings (#28628)
• 2ec644a [device][Android] Replace deprecated method to get rotation (#28627)
• 46dc5b3 [docs] Update new arch guide to account for fixed navigation issue
• 6df141b [docs] Fix `zulu` installation command for SDK 49 and below (#28612)
• 393ca27 [docs] Improve example in Use Bun guide (#28615)
• b142541 [iOS] Make it easier to use the new architecture in bare-expo (#28616)
• 1fcceda [core][Android] Make `defaultAppContextMock` private (#28620)
• 0adb5e6 [docs] show "Unversioned" API version in PR previews (#28588)
• 72fd8e2 [expo-go] Remove unused queries and overfetched fields (#28619)
• f57dfd1 [templates] Update to latest [skip ci]
• 2d80ee3 Publish packages
• a8060e8 Publish packages

See the full diff

Package name: expo-splash-screen

The new version differs by 250 commits.

• 0897aea Publish packages
• 216e960 Publish packages
• df6af6d [eslint-config-expo] Resolve TypeScript "paths" (#28378)
• 9b2c0f2 [cli] Run eslint directly rather than lint script (#28332)
• d698984 [expo-go] Publish prod home [skip ci]
• 4cb0783 Update Podfile locks after changes in expo-image-manipulator [skip ci]
• 841796d [image][iOS] Fix maintaining animated images duration after resizing (#28371)
• 041b687 [docs] Add doc for fingerprint runtime version and CI/CD (beta) (#28310)
• d80bdbb [sqlite] bump sqlite to 3.45.3 and enable bytecodevtab (#28358)
• eb59156 [core] fix build.gradle backward compatibility for previous expo modules (#28359)
• de7294e [config-plugins] Remove warning when using fingerprint (#28329)
• 74a0778 [expo-updates][cli] Add --debug option to fingerprint:generate command (#28311)
• 18fc422 [sdk-51] upgrade react native 0.74.0 (#28368)
• 1927a49 fix(server): serve hoisted index routes (#28348)
• b4ff318 [dev-client] fix deep linking launch error (#28339)
• 5585320 [image-manipulator] add webp support for Android and iOS (#26379)
• c158ef2 [docs] Fix multiple minor issue (#28365)
• 6ae1b17 [android][image-picker] fix getting filename and filesize from cropped images (#28352)
• f709c82 [docs] Fix vale warning in Stripe SDK 51 reference (#28357)
• 22e8580 [docs] Update Expo Go landing page links (#28356)
• 78c1de6 [core] fix AppContext null currentActivity (#28338)
• c9b0dc7 [image][ios] fix resizing animated images failing to preserve animation (#28335)
• 691b672 [docs] Add Expo Symbols reference to SDK 51 (#28350)
• 38b9631 [docs] Add Links rule to avoid vague text in Vale and update other rules (#28354)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)