chore: resolve reported dependency security advisories

[dannyhw]

Brings pnpm audit from 150 advisories (3 critical / 70 high / 67 moderate / 10 low) down to 4 (3 high / 1 moderate).

Why there was so much to fix

Most findings were stale lockfile resolutions, not real version constraints — the committed lockfile held transitive dependencies well below what their parents' declared ranges already allowed. Re-resolving in range cleared the bulk of them with no overrides at all.

One gotcha worth recording: deleting pnpm-lock.yaml is not enough to force re-resolution. pnpm falls back to its virtual-store copy at node_modules/.pnpm/lock.yaml, so both have to be removed.

Published packages

• dev-server raises @fastify/middie, fastify, http-proxy-middleware, launch-editor and ws. This also clears path-to-regexp, find-my-way and fast-uri transitively.
• repack raises image-size, and pins terser-webpack-plugin to 5.5.0 — see below.

Everything stays within existing majors, so there are no API changes.

terser-webpack-plugin is pinned to 5.5.0

This started as a bump to ^5.6.1 (5.6+ dropped the vulnerable serialize-javascript). That was wrong — it walks straight into #1390. Confirmed against the tester app:

	index.bundle	flag
main	2.55 MiB	[minimized]
with ^5.6.1	7.36 MiB	none

It affected webpack as well as Rspack. And a plain revert to ^5.3.14 isn't sufficient — that range permits 5.6.1, so any fresh install lands on the broken version. main only avoids it through a stale lockfile entry, which is the underlying cause of #1390.

5.5.0 is the last release before the regression, and serialize-javascript was already dropped in 5.3.17 — so a single known-good version fixes the advisory with no override and no upper-bound range to explain. Verified minifier output is unchanged from main by pinning to main's exact 5.3.16 as a control: identical size, miniapp chunk 975 bytes vs 979 before.

Note this pin only governs the fallback copy: getMinimizerConfig prefers a terser-webpack-plugin in the project root, so a consumer who has 5.6.x of their own still hits #1390. A real fix still needs the Rspack SWC minimizer path, or a version check that warns.

Minification is now actually tested

bundle.test.ts only compared emitted filenames, so a no-opping minimizer passed silently — which is why this nearly shipped. It now asserts the output is minified, verified in both directions: ~1.1M chars/line when minified, 44.5 with 5.6.1 forced (fails on all four bundler/platform combos).

Overrides

Only where a parent pins an exact version, so no upgrade can reach the fix. @module-federation/dts-plugin pins koa: 2.15.3, ws: 8.18.0 (0.8.9, via repack's devDependency) and adm-zip: 0.5.10 (2.8.0). Every 0.x dts-plugin release pins ws: 8.18.0 exactly, so moving within 0.x wouldn't avoid them. koa and ws stay within their installed major; adm-zip 0.6.0 is a major only because it raises the required Node version — its API is 0.5.18's plus applyDirAttributes, nothing removed.

Two other versions held back

Both commented at their definition:

• @rspack/core pinned to 1.6.0. Measured per version:

rspack	type errors	snapshot-only diffs	real assertion failures
1.6.0	0	0	0
1.6.1	0	7	0
1.6.2	0	4	2
1.6.3	0	4	2
1.6.4	3	—	2
1.7.x	3	—	polyfills runtime module absent

From 1.6.2 onward repack's Module Federation v2 polyfill startup ordering assertions genuinely fail, 1.6.4+ additionally fails build:ts, and on 1.7.x webpack/runtime/repack/polyfills is missing from the bundle entirely. Only 1.6.0 is fully green; 1.6.1 differs in snapshot text alone. Worth folding into the Rspack 2 work.

• webpack held on 5.105.x. 5.106.0 removed the internal webpack/lib/util/create-schema-validation, replacing it with a public validate option and an in-plugin validation API (webpack#20275). @module-federation/enhanced below 2.4.0 deep-imports the removed path via normalizeWebpackPath, so builds throw MODULE_NOT_FOUND. Verified with a real webpack 5.109.0 build: MF 2.0.1 fails, MF 2.8.0 builds fine. MF fixed this in 2.4.0, so it is not a repack limitation and needs no upstream report — the hold exists only because repack's MF devDependency is 0.8.9 and tests/integration deliberately pins 0.15.0 / 0.21.0 / 2.0.1 as a compatibility matrix. Users on MF >= 2.4.0 can use webpack 5.106+.

The website also pins @callstack/rspress-preset/-theme to 0.6.0; 0.6.7 drops its require export condition and fails the docs build.

memfs floats again — its Volume#toTree() ordering change is cosmetic, so the two affected assets-loader snapshots are updated rather than pinning around it. Recorded file sets are unchanged.

Remaining four have no reachable fix

• react-router needs 8.3.0, but react-router-dom@7.18.1 pins react-router: 7.18.1 exactly, and even the latest @rspress/core is still on react-router-dom: ^7.18.1. The advisory covers RSC mode, which a static docs site doesn't use.
• brace-expansion is patched only in 5.0.8, whose CommonJS build exports a named expand instead of assigning module.exports. minimatch 3.x/8.x call the module directly, so an override throws at require time. Reaching it needs minimatch 10, but @babel/cli pins glob 7 and babel-plugin-module-resolver pins glob 9 — both already at their latest release.
• uuid in xcode doesn't apply: the advisory covers v3/v5/v6 when buf is passed, and xcode only calls uuid.v4(). An override also wouldn't change what repack-init consumers resolve.

Follow-up

repack's MF devDependency stays at 0.8.9. Moving to 2.x would drop the koa/ws overrides, but MF 2.x renamed the runtime types (FederationRuntimePlugin → ModuleFederationRuntimePlugin, FederationHost → Federation) and those names are re-exported from repack's published .d.ts, so it would break typings for anyone on MF 0.x/1.x against the current >=0.6.10 peer range. The better fix is to stop re-exporting MF's types from repack's public surface.

Verification

build 7/7, typecheck 11/11, test 10/10 — matching main, now including the minification assertion.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9835deb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@callstack/repack	Patch
@callstack/repack-dev-server	Patch
@callstack/repack-plugin-expo-modules	Patch
@callstack/repack-plugin-nativewind	Patch
@callstack/repack-plugin-reanimated	Patch
@callstack/repack-init	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repack-website	Ready	Preview, Comment	Jul 26, 2026 6:25pm