chore: resolve dependency security advisories

[dannyhw]

Summary

Resolves most open Dependabot alerts and pnpm audit findings, preferring version updates over overrides. pnpm audit goes from 99 (3 critical, 58 high) to 6 (0 critical, 3 high). None of the 6 that remain have a fix that can be reached without an override.

Shipped packages

• @callstack/repack: image-size ^1.2.1 → ^2.0.4 (ICNS/JXL/HEIF infinite-loop DoS; no 1.x fix exists). This is a major bump, but our only call site is imageSize(buffer) in the assets loader, and that API is the same in v2. Engines stay at node >=18, and nothing about image-size is exposed to consumers.
• @callstack/repack-dev-server: fastify floor ^5.10.0 → ^5.12.5 (several advisories, all within 5.x).

Tester apps / website / tooling (internal)

• @module-federation/enhanced / runtime (testers catalog) 2.8.0 → 2.9.2. This release ships patched undici/ws/adm-zip, so the dts-plugin@2.8.0>undici override is removed.
• @rsdoctor/rspack-plugin 1.5.2 → 1.6.4 (unauthenticated HTTP API advisory; 1.6.5 is still inside the minimumReleaseAge window).
• @rspress/core 2.0.0 → 2.0.23 (drops vulnerable tinypool).
• vitest catalog ^4.1.0 → ^4.1.11.
• Ruby json gem 2.21.1 → 2.21.2 in the tester apps' Gemfile.lock.
• Re-resolved transitive deps within their existing ranges: shell-quote, axios, fast-uri, @xmldom/xmldom, joi, js-yaml, svgo, brace-expansion, engine.io, source-map-js, compression, qs, nanoid.

Overrides

• Kept koa@2, koa@3, ws@8, adm-zip (raised to ^0.6.1). These are now only reached through the older MF versions pinned on purpose for compatibility coverage (packages/repack devDep 0.8.9, tests/integration 2.0.1/0.15/0.21). The comment has been updated to say this.
• No new overrides added.

Remaining (no fix reachable without an override)

Package	Path	Reason
image-size 1.x	tester-expo → metro	metro pins ^1.x
decode-uri-component	tester-expo → expo-router → query-string 7	needs 0.5 (ESM-only), incompatible with query-string 7
postcss-selector-parser	tester-app → tailwindcss 3	needs v7; tailwind 3 requires v6
node-forge, braces, sprintf-js	expo cli / babel cli / changesets	no patched version published

Test plan

• pnpm build, pnpm typecheck, pnpm test pass
• Integration assets-loader snapshots (width/height) unchanged with image-size v2
• pnpm lint:ci (only an existing warning in repack-expo)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
repack-website	Ready	Preview	Oct 9, 2026 8:04pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 49bb712

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@callstack/repack	Patch
@callstack/repack-dev-server	Patch
@callstack/repack-plugin-expo-modules	Patch
@callstack/repack-plugin-nativewind	Patch
@callstack/repack-plugin-reanimated	Patch
@callstack/repack-init	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR