Fix parse-duration, serialize-javascript, and uuid CVEs (REV-43)

[revopushbot]

Clears three Dependabot advisories in the CLI. Independent of #37 (aab-parser/protobufjs).

parse-duration — CVE-2025-25283 (HIGH, ReDoS)

Direct dep, bumped 1.1.0 → ^2.1.6. Only used to parse an access-key --ttl string in command-parser.ts.

• v2 is ESM-only, so require() yields the namespace and the parser is .default.
• v2 returns null (v1 returned NaN) for unparseable input; ?? 0 preserves v1's Math.floor(...) === 0 behavior.
• Verified byte-identical to v1 across 18 TTL inputs (compound 1h30m, decimals, empty, garbage, negatives).
• Adds engines: node >=20.19.0, required for require(esm). Acceptable: Node 18 is EOL and RN toolchains already need Node 20+.

serialize-javascript — GHSA-5c6j-r48x-rmvq (HIGH, RCE/DoS)

Transitive via mocha (devDependency → 6.0.2); never shipped to consumers. No 6.x patch exists, so pinned via overrides to ^7.0.5 (resolves 7.0.7).

uuid — CVE-2026-41907 (MODERATE, ReDoS)

Transitive via xcode@3.0.1 → uuid@7.0.3. No fixed xcode release exists (npm's only suggestion is a downgrade), so pinned via overrides to ^11.1.1.

• Verified compatible with xcode's uuid.v4() usage — xcode.generateUuid() still produces valid pbxproj IDs.
• Caveat: xcode is a runtime dep, so (like protobufjs in Replace unmaintained aab-parser to clear protobufjs CVEs (REV-36) #37) this override cleans CI/this repo but doesn't reach published-CLI consumers until xcode ships a fix upstream. uuid is used only to generate v4 IDs here, not parse untrusted input, so the ReDoS isn't reachable in practice.

Verification

• ✅ tsc clean; no new lint errors
• ✅ CLI boots (--version works → require(esm) OK at load)
• ✅ xcode.generateUuid() works under uuid@11.1.1
• ✅ npm audit clear for all three

Note

The uuid alert was surfaced under the react-native-code-push-next repo — that repo needs its own separate fix.

Closes REV-43.

🤖 Generated with Claude Code