chore(deps): consolidate Dependabot updates

[lv10]

Consolidates the open Dependabot PRs listed below into a single reviewable change.
Lockfiles were regenerated so the dependency graph stays coherent.

All four Dependabot PRs carry transitive-only security patches (five package
instances) — no package.json in this repo declares any of them, so no manifest was
edited. Each lockfile was updated with
npm update <pkg> --package-lock-only --lockfile-version=<existing>, preserving each
project's original lockfileVersion (3 in step0, 2 in step1–step5).

Included updates (npm)

Package	From	To	Bump	Supersedes	Lock resolves
nanoid	3.3.6	3.3.18	patch	#96 (/step5)	✅
brace-expansion	1.1.11	1.1.18	patch	#97 (/step5)	✅
brace-expansion (nested under babel-plugin-module-resolver)	2.0.1	2.1.4	patch	#97 (/step5)	✅
@babel/helpers	7.23.2	7.29.7	minor	#98 (/step4)	✅
@babel/runtime	7.23.2	7.29.7	minor	#99 (/step5)	✅

Applied to every step project, not just the one Dependabot picked

Dependabot raised each of these against a single directory, but step0–step5 are six
copies of the same workshop app and all six carried the identical vulnerable versions.
Patching only /step4 and /step5 would leave the same advisories open in the other
four, so all six lockfiles were updated. This matches how the previous consolidation
(#93) handled js-yaml.

Transitive packages that moved with them

Pulling @babel/helpers / @babel/runtime up to 7.29.7 moves the Babel internals they
require, and nothing else moved. The complete set of resolved-version changes, identical
in all six lockfiles:

@babel/code-frame                  7.22.13 -> 7.29.7
@babel/helper-string-parser         7.22.5 -> 7.29.7
@babel/helper-validator-identifier  7.22.20 -> 7.29.7
@babel/helpers                      7.23.2 -> 7.29.7   (target)
@babel/parser                       7.23.0 -> 7.29.8
@babel/runtime                      7.23.2 -> 7.29.7   (target)
@babel/template                    7.22.15 -> 7.29.7
@babel/types                        7.23.0 -> 7.29.8
brace-expansion                     1.1.11 -> 1.1.18   (target)
brace-expansion (nested)             2.0.1 -> 2.1.4    (target)
nanoid                               3.3.6 -> 3.3.18   (target)
picocolors                           1.0.0 -> 1.1.1
regenerator-runtime                 0.14.0 -> removed  (no longer required by @babel/runtime 7.29)
to-fast-properties                   2.0.0 -> removed  (no longer required by @babel/types 7.29)

slides/package-lock.json is deliberately untouched — see "Already current on main".

Verification

Run locally with Node 20.20.2 (the deploy workflow pins node-version: 20). n/a means
the project defines no such step. A baseline run of npm ci and the slides build on
main passed too, so nothing here is masking or absorbing a pre-existing failure.

• install (npm ci, lock resolves): ✅ in all seven projects — slides, step0–step5
• build: ✅ npm run slides:build -- --base /react-native-workshop/ in slides.
  step0–step5 define no build script (only start/android/ios/web) → n/a
• tests: n/a — no project in this repo defines a test script
• lint: n/a — no project in this repo defines a lint script

npm ci only proves the lockfile resolves; it does not exercise the bumped Babel
packages. So each step app's own sources were additionally transformed through that
project's babel.config.js (babel-preset-expo + react-native-reanimated/plugin)
using its installed @babel/core. All 11 app source files across step0–step5
compiled to non-empty output, and every @babel/runtime helper path the transform
emitted (helpers/interopRequireDefault, helpers/slicedToArray) was checked to resolve
on disk against the installed 7.29.7 — none missing. This covers the app sources only;
Metro also transforms node_modules at bundle time, which nothing in this repo can run
headlessly.

The slides build output is unchanged from the baseline — identical file set and sizes
(68 files, 1,371,263 bytes) — which is expected, since slides is not modified.

Security impact

npm audit per step project: 55 → 51 (step5: 54 → 50). The cleared entries are
exactly nanoid, brace-expansion, @babel/helpers and @babel/runtime; no new
advisory appeared.

Of the ~51 that remain, 35 are ones npm reports as needing a semver-major of expo
(23) or react-native (12) — those are the SDK migration tracked in #94. The other
15–16 (form-data, shell-quote, cross-spawn, minimatch, micromatch, picomatch,
tmp, @babel/core, @babel/plugin-transform-modules-systemjs, yaml, joi,
compression, serve-static, on-headers, @expo/devcert, braces) are marked
in-range fixable, but Dependabot has not raised PRs for them and they are outside this
consolidation's scope — see "Known and accepted".

slides holds 21 advisories, unchanged base-to-head (it is not modified here); 15 of
those need a @slidev/cli major.

Already current on main

• Bump nanoid from 3.3.7 to 3.3.18 in /slides #95 — nanoid 3.3.7 → 3.3.18 in /slides. slides/package-lock.json on main
  already resolves nanoid to 3.3.18; the previous consolidation (chore(deps): consolidate Dependabot updates #93) picked it up
  when it refreshed the slides toolchain. This PR needs no change for it, and Bump nanoid from 3.3.7 to 3.3.18 in /slides #95 is
  closed as already applied.

Left open — Expo SDK / React Native migration (tracked in #94)

Not consolidation work; these need a human with a simulator. Unchanged from the
assessment in #94, and if anything the gap has widened since:

• Bump tar and expo in /step1 #90 /step1, Bump tar and expo in /step2 #82 /step2, Bump tar and expo in /step3 #91 /step3, Bump tar and expo in /step4 #92 /step4, Bump tar and expo in /step5 #88 /step5 — tar
  6.2.1 → 7.5.5/7.5.7 by way of expo 49.0.16 → 54.0.31/54.0.32. tar is not a direct
  dependency; the only route to it is the Expo SDK major — @expo/cli@0.10.17, which
  Expo 49's final release (49.0.23) pins, still declares tar ^6.0.5, so there is no
  in-line patch. Upstream expo is now at 57.0.17, making Dependabot's 54 target
  itself two SDK generations stale; the migration should target a current SDK, not 54.
  Note also that the tar advisory range now extends to <=7.5.20, so Dependabot's own
  7.5.5/7.5.7 target would not clear it either.
• Bump @react-native-community/cli and react-native in /step1 #72 /step1, Bump @react-native-community/cli and react-native in /step2 #71 /step2 — react-native 0.72.6 → 0.82.1 plus
  @react-native-community/cli. Upstream react-native is now at 0.87.1; same
  reasoning as above.

Expo 49 → a supported SDK pulls React 18 → 19, @types/react,
react-native-reanimated, react-native-safe-area-context and the Babel config with it,
expo install --fix picks those versions per SDK, and step0–step5 have no automated
test signal at all — every step has to be run on a device or simulator. The workshop
slides also teach against SDK 49 APIs. See #94.

Known and accepted

• This repo has no CI on pull requests. .github/workflows/deploy.yml is the only
  workflow and triggers on push to main only, so this PR will show no checks. The
  verification above is the only signal available; the slides build it runs is the same
  command the deploy workflow runs — and slides is untouched here, so CI behaviour after
  merge is unchanged.
• Mixed Babel versions in the step lockfiles. @babel/helpers, types, parser,
  template and code-frame land on 7.29.x while @babel/core, traverse, generator
  and the @babel/plugin-* set stay at 7.22–7.23. This is exactly the tree Dependabot's
  own Bump @babel/helpers from 7.23.2 to 7.29.7 in /step4 #98/Bump @babel/runtime from 7.23.2 to 7.29.7 in /step5 #99 produce — neither raises @babel/core — and the transform smoke test above
  was run specifically to confirm the skew compiles. Aligning @babel/core is in range
  (^7.20.0) and would also clear two of the advisories listed above, but it is not part
  of any Dependabot PR and is left for a separate change rather than widened into this one.
• The 15–16 in-range-fixable advisories are deliberately not touched here. They were
  not raised by Dependabot, clearing them would move packages this PR has no mandate over,
  and mixing them in would make the lockfile diff hard to audit against the four PRs being
  folded in. They are worth a follow-up PR of their own.

[SociableSteve]

Approving. Applying each advisory across all six step projects rather than the one directory Dependabot happened to raise it against is the right call, and the diff shows it was done uniformly: step1 through step5 carry identical version changes, and step0 carries the same set minus the legacy mirror it does not have.

I confirmed the scope claim directly. The diff is six package-lock.json files and nothing else, no package.json anywhere is touched, and slides/ is left alone. Since no manifest in the repo declares any of the five bumped packages, they are genuinely transitive-only and there is no manifest-versus-lock skew available to get wrong. lockfileVersion is preserved as claimed, 3 in step0 and 2 in step1 to step5, and for the v2 files both the packages tree and the legacy dependencies mirror moved together, so an npm 6-era reader sees the same tree.

The advisory coverage holds: nanoid 3.3.18, brace-expansion 1.1.18 and nested 2.1.4, and both Babel packages at 7.29.7 are each well past their advisories' fixed versions. The pruning leaves nothing dangling: to-fast-properties has no remaining reference, and regenerator-runtime survives only as react-native's own nested 0.13.11, which its ^0.13.2 range requires. There is no prior review history, so nothing carries forward.

The native-side trap does not apply here, which is worth stating rather than leaving implied: there is no ios/ or android/ directory in any step, these are managed-workflow Expo apps, and nothing in this diff bumps expo or react-native. Nothing here implies a Podfile or gradle change.

No findings, and nothing I want changed. One thing to hand back as evidence rather than as a request: your body says the Metro node_modules transform is the residual risk and that "nothing in this repo can run headlessly". It can. During the review pass npx expo export --platform android produced a full production bundle at head for both step0 and step5, Hermes bytecode included, at 826 kB and 1.23 MB. So the mixed Babel tree, with helpers, types, parser and template at 7.29.x against core, traverse and generator at 7.22 to 7.23, survives a real bundle and not just an app-source transform. That was the review pass's execution rather than mine, but it closes the gap you flagged, and it is worth knowing the check exists for next time.

Context for whoever lands this: the repo defines no test or lint script in any of its seven projects and has no CI on pull requests, so there is no green tick standing behind this beyond npm ci resolving. That is a pre-existing shape rather than anything this PR changes, and your body says so accurately.