chore: resolve remaining dependency security advisories

[dannyhw]

Summary

Resolves the Dependabot advisories outstanding after #1409 — 23 of the 25 open alerts — and upgrades the example apps to React Native 0.86.0, which is what made the Ruby side possible. No shipped runtime code changes; the only packages/ diff is one devDependency bump in dev-server.

Ruby — all advisories cleared

The blocker was that every patched activesupport needs Ruby >= 3.1, while the testers pinned 2.7.6. Moving to Ruby 3.3 didn't work: CocoaPods intermittently dies with ArgumentError - pathname contains null byte in project.rb:452 while resolving pnpm's symlinked node_modules (CocoaPods#12866 — a pnpm-monorepo-specific issue, which is why plain RN projects on 3.3 are fine). On 3.3.10 it succeeded roughly 1 run in 6.

Ruby 3.4.9 fixes it — 6/6 clean pod install runs (rm -rf Pods each time) across all three apps. Ruby 3.4 also dropped kconv from stdlib, which CocoaPods needs, so the Gemfiles gain gem 'nkf' (the RN community template already carries this line; ours didn't).

• activesupport 7.1.3.3 → 7.2.3.1 (GHSA-2j26-frm8-cmj9, GHSA-cg4j-q9v8-6v38, GHSA-89vf-4333-qx8v)
• addressable 2.8.6 → 2.9.0 (GHSA-h27x-rffw-24p4)
• concurrent-ruby 1.3.1 → 1.3.8 (GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp, GHSA-6wx8-w4f5-wwcr)

.ruby-version → 3.4.9 in all three testers, mise.toml aligned to ruby = "3.4", and the Gemfiles document why 3.4 is the real floor.

JavaScript overrides

• esbuild@<0.25.0 → ^0.25.0 (GHSA-67mh-4wv8-2f99). Only reachable through @modern-js/node-bundle-require inside @module-federation/cli; no parent release carries the fix.
• uuid@7 → ^11.1.1 (GHSA-w5hq-g745-h8pq). xcode pins uuid to ^7 and is unmaintained. It only calls uuid.v4(), which the advisory (a buf bounds check in v3/v5/v6) does not cover — this silences the alert rather than closing real exposure.

React Native 0.86.0

0.87 is not viable: it's unreleased (rc.2) and react-native-test-app@5.4.5 declares react-native: "0.76 - 0.86 || >=0.86.0-0 <0.87.0", with no prereleases that support it. 0.86.0 is the ceiling.

• react-native 0.84.1 → 0.86.0, react 19.2.3 → 19.2.8, RNTA 5.1.0 → 5.4.5, @react-native/babel-preset + typescript-config → 0.86.0, @react-native-community/cli* 20.1.2 → 20.2.0, Gradle wrapper 9.0.0 → 9.3.1
• reanimated 4.2.2 → 4.5.3 and worklets 0.7.4 → 0.11.3 (4.2.2 does not support 0.86; 4.5.3 declares 0.83 - 0.86), svg → 15.15.5, safe-area-context → 5.8.0, async-storage → 3.1.1, screens → 4.26.2, nativewind → 4.2.6, css-interop → 0.2.6, react-navigation native → 7.3.14 / native-stack → 7.18.6

Three things the upgrade surfaced:

1. The MF v2 configs hardcoded shared singleton versions. requiredVersion was the literal '19.2.3' / '0.84.1' (react and react-native use catalog:, so pkg.dependencies is unusable for them). After the bump the federation runtime rejected both shared singletons and the Gallery mini app failed to resolve. They now read the installed package versions so they cannot drift on the next upgrade.
2. @react-navigation/native-stack 7.18.6 removed headerBackTitleVisible → headerBackButtonDisplayMode.
3. @react-native/dev-middleware 0.86 throws from DefaultToolLauncher under NODE_ENV=test unless the caller injects a mock. tester-app's suites boot a real dev server, so its vitest config now sets NODE_ENV=development.

Left open — no compatible fix upstream

brace-expansion (GHSA-mh99-v99m-4gvg, high). Only 5.0.8 is patched; every other line, including the current maintenance-v1/maintenance-v2 tags, is in range. 5.0.8 moved from module.exports = expand to a named expand export, so minimatch 3.x (var expand = require('brace-expansion')) and 8.x (__importDefault) both break under an override. Dev-only here — absent from the production graph of every shipped package.

react-router (GHSA-qwww-vcr4-c8h2, high). Patched only in 8.3.0. react-router-dom has no 8.x line and the latest @rspress/core (2.0.18) still requires react-router-dom ^7.18.1. Website-only, and the advisory covers RSC server mode, which a static Rspress build does not run.

Both are dismissal candidates in the Dependabot UI rather than a code change.

Test plan

• pnpm build, pnpm typecheck, pnpm lint:ci — pass
• pnpm turbo run test --force — 10/10 tasks pass (cache bypassed)
• bundle exec pod install — passes on all three apps under Ruby 3.4.9, repeatedly and from a clean Pods/
• Merged origin/main (ci: restore Node 18 test support and extend matrix to Node 26 #1411); both conflicts were append-to-the-same-list cases — kept both override groups in pnpm-workspace.yaml, and regenerated pnpm-lock.yaml so main's vite hold and exact @rsdoctor/rspack-plugin pin are reflected

On a Pixel 9 emulator, all three testers on RN 0.86:

• tester-app — async chunk resolves, mini-app install/show toggles, assets render local/inline/remote at x3, Reanimated box springs on Click, NativeWind renders every case and dark: variants flip the whole screen
• tester-federation (MF v1) — host loads, Gallery mini app loads from the :8082 container with its own navigation and remote images
• tester-federation-v2 (MF v2) — host loads, Gallery mini app loads from the remote container, Host assets renders both the inlined (89,400 bytes) and emitted (121,569 bytes) variants

Not covered

• No iOS xcodebuild on RN 0.86. Pods install cleanly on all three, but the last full iOS build+launch was on 0.84.1.
• Node 18 not exercised. ci: restore Node 18 test support and extend matrix to Node 26 #1411 just restored Node 18 to the matrix. RN already required >= 20.19.4 at 0.84.1 so the engines aren't newly violated, but I didn't run the suite on Node 18.
• New harmless peer warning: @react-native/metro-config missing, since Re.Pack replaces Metro.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f3ef993

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repack-website	Ready	Preview, Comment	Jul 26, 2026 8:51pm