[MelvinBot]

Details

Bumps transitive braces 3.0.2 → 3.0.3 (and its dependency fill-range 7.0.1 → 7.1.1, required by [email protected]) in package-lock.json to fix GHSA-grv7-fg5c-xmjg (uncontrolled resource consumption). All dependents use ^3.0.2 / ~3.0.2, so no package.json change.

Usage: Not imported in src, not shipped in dist. Dev/build tooling only: glob matching via micromatch (fast-glob for ESLint, Metro/Jest from the react-native peer) and chokidar (@babel/cli).

Change Log

braces 3.0.3:

• Fix vulnerability: unbounded memory on imbalanced braces (SNYK-JS-BRACES-6838727, GHSA-grv7-fg5c-xmjg)
• Add maxSymbols option
• Lint/test fixes

fill-range 7.1.1:

• Ensure maxLen is passed down to handle zero-padding
• Lint updates

Related Issues

https://github.com/Expensify/Expensify/issues/695899

Manual Tests

1. npm ci → installs cleanly.
2. npm ls braces fill-range → only [email protected], [email protected].
3. npm run build → compiles all files to dist.
4. npx eslint src → no errors.

Not run by MelvinBot (npm unavailable in its sandbox). Lockfile entries were edited by hand using the npm registry's resolved/integrity values.

Linked PRs

None. Dev-only lockfile change, no release needed.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[inimaga]

@MelvinBot sign the CLA

[chiragsalian]

Archiving this repository so closing out this PR