[MelvinBot]

Details

Bumps cross-spawn 7.0.3 → 7.0.6 in package-lock.json to fix GHSA-3xgq-45jj-v275 (ReDoS). Lockfile-only; dependencies of cross-spawn are unchanged.

Usage: Not used by our code or shipped in the package. It's a transitive dev dependency of eslint and of the react-native CLI (via execa), used to spawn child processes during local tooling.

Change Log

• 7.0.6: Update package-lock.json version.
• 7.0.5: Fix escaping bug introduced by backtracking fix.
• 7.0.4: Disable regexp backtracking (ReDoS fix).

Related Issues

https://github.com/Expensify/Expensify/issues/695898

Manual Tests

1. npm ci succeeds and npm ls cross-spawn shows only 7.0.6.
2. npx eslint src, npx prettier . --check, and npm run ts pass.
3. npm run build succeeds.

Linked PRs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[lakchote]

@MelvinBot sign the CLA.

[lakchote]

recheck

[chiragsalian]

Archiving this repository so closing out this PR