[MelvinBot]

Details

Removes ip (fixes GHSA-2p57-rm9w-gvfp, GHSA-78xj-cgh5-2h22). No ip release patches the high-severity alert, so the package has to go.

Overrides @react-native-community/cli-doctor and cli-hermes 11.3.5 → 11.4.1, the only release that drops ip. Their sibling CLI deps stay pinned at 11.3.5. Without these pins, the whole CLI and Metro would cascade. 11.4.1 only uses stable sibling APIs (logger, CLIError, getAndroidProject).

Usage: Not used by this library's code. ip comes in only through the react-native peer dep's CLI in our local dev install. The CLI never runs here (build is tsc + babel). Nothing ships to consumers.

I edited the lockfile by hand from registry metadata because npm install wasn't available. npm ci passes, npm ls --all shows no problems, and npm ls ip is empty.

Change Log

• 11.4.1 — replace ip with a default value and --host flag (#2299); hermes downloads the correct sourcemap for dev/prod profiles
• 11.4.0 — Metro ^0.76.9
• 11.3.10 — run CI on every branch
• 11.3.9 — perf: remove Gradle task check on run-android
• 11.3.8 — avoid chmod on read stream close
• 11.3.7 — fix iOS --mode crash; get only tasks for right type
• 11.3.6 — semver 6 → 7.5.2; Flipper protocol and DevTools fixes; Homebrew for ios-deploy; Metro 0.76.8

Related Issues

$ https://github.com/Expensify/Expensify/issues/695900

Manual Tests

1. npm ci succeeds. npm ls ip is empty, and npm ls --all shows no errors.
2. npm run build, npm run ts, npx eslint src, and npx prettier . --check pass.
3. npx react-native doctor runs without errors.
4. After merge, confirm both ip Dependabot alerts close.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR