[MelvinBot]

Details

Bumps compression 1.7.4 → 1.8.2 in package-lock.json to fix GHSA-vc2v-76pw-4v95 (DoS via memory leak on premature response close). Lockfile-only; also pulls in on-headers 1.1.0 (fixes CVE-2025-7339).

Usage: Not used by this library's code. It's a transitive peer dependency (react-native → @react-native-community/cli → cli-server-api → compression), used only as gzip middleware for the local Metro dev server. It is not shipped in the published dist.

Change Log

1.8.2

• Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)
• deps: add [email protected]
• Match Cache-Control: no-transform case-insensitively

1.8.1

• deps: on-headers@~1.1.0 (fixes CVE-2025-7339)

1.8.0

• Use res.headersSent when available
• Replace _implicitHeader with writeHead
• Add brotli support
• Add enforceEncoding option

1.7.5

• deps: replace accepts with negotiator@~0.6.4
• deps: [email protected], compressible@~2.0.18, [email protected]

Related Issues

$ https://github.com/Expensify/Expensify/issues/695862

Manual Tests

1. npm ci, then npm ls compression shows [email protected].
2. npm run ts, npm run build, and npx eslint src pass.
3. npm audit no longer lists compression.
4. Optional: in a consuming RN app, start Metro (npx react-native start) and confirm the bundle loads.

Melvin ran steps 1–3 in a node:24 container and passed. It also confirmed the compression middleware still returns Content-Encoding: gzip.

Linked PRs

None

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR