x-randomvalues: declare NativeModules locally; resolve braces to @pezkuwi/braces

x-randomvalues read one export from react-native, NativeModules, and
took its types from the deprecated @types/react-native, which depends
on react-native itself: react-native 0.83, metro 0.83 and with them
image-size (open advisory, fixed only in 2.x, which metro 0.83 does not
accept). The two native modules it looks for are now declared in
src/react-native-modules.d.ts; the casts to RNExt are gone and each
module is checked before use. The published react-native.d.ts does not
reference react-native, and react-native/metro leave the dependency
tree.

braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
This commit is contained in:
Satoshi Qazi Muhammed committed 2026-10-10 04:01:02 +04:00
1 parent 090f7f35e2
commit 81e25b008b
5 files changed
+80 -1885

No files matched your search

-3
View File
@@ -23,9 +23,6 @@
"@pezkuwi/x-global": "14.0.26",
"tslib": "^2.8.0"
},
"devDependencies": {
"@types/react-native": "^0.73.0"
},
"peerDependencies": {
"@pezkuwi/util": "14.0.26",
"@pezkuwi/wasm-util": "*"