Dev: react-native 0.87, vue 3; resolve braces to @pezkuwi/braces

sprintf-js, fast-xml-parser and image-size all came from the
react-native 0.73 dev dependency (its CLI 12 and metro 0.80); none has
a fix those versions accept. react-native 0.87 no longer depends on the
CLI and uses metro 0.87. vue-identicon builds against vue 3 now; at run
time it already supports both 2 and 3 (adaptVNodeAttrs) and its peer
range stays >= 2.7. The vue 2 advisory is fixed only in vue 3.

braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.

package.json

@@ -39,9 +39,10 @@
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "react-is": "^18.2.0",
-    "react-native": "^0.73.1"
+    "react-native": "^0.87.1"
   },
   "resolutions": {
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "typescript": "5.5.4"
   }
 }

packages/vue-identicon/package.json

@@ -28,7 +28,7 @@
     "tslib": "^2.8.1"
   },
   "devDependencies": {
-    "vue": "^2.7.16"
+    "vue": "^3.5.22"
   },
   "peerDependencies": {
     "@pezkuwi/util": "*",