[MelvinBot]

Details

Bumps transitive dev dependency cross-spawn 7.0.3 → 7.0.6 in package-lock.json to fix the ReDoS Dependabot alert (CVE-2024-21538). Lockfile-only change. No API changes.

Usage: not imported by this library. It's pulled in only by dev tooling: eslint and react-native → @react-native-community/cli-platform-android → execa. It isn't shipped in dist.

Change Log

• 7.0.6: update cross-spawn version to 7.0.5 in package-lock.json
• 7.0.5: fix escaping bug introduced by backtracking
• 7.0.4: disable regexp backtracking (ReDoS fix)

Full log: https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md

Related Issues

$ https://github.com/Expensify/Expensify/issues/695879

Manual Tests

1. npm ci, then npm ls cross-spawn shows only 7.0.6.
2. npm run lint and npm run ts pass. This runs eslint, which uses cross-spawn.
3. npm run build succeeds.

AI ran steps 1 and 2: both passed.

Linked PRs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[AndrewGable]

recheck

[os-botify]

🚀 Published to npm in 1.0.20 🎉