flagon-io/g1t

package-lock.json now resolves decode-uri-component 0.5.0 instead of 0.2.2. I checked the lockfile, but I did not run the app or the project's tests successfully.

Nothing in the repo uses the package directly. It came in through query-string 7.1.3, which expo-router (via expo-router's own dependencies) pins to ^7.1.3. Overriding only decode-uri-component to 0.5.0 would break at runtime. That version is ESM-only, so the CommonJS require('decode-uri-component') inside query-string 7 would return a module object rather than a function.

So I added an overrides entry in package.json that moves query-string to ^9.5.1. That version depends on decode-uri-component ^0.5.0 and is written for ESM. The lockfile also picks up newer filter-obj and split-on-first, and drops strict-uri-encode. expo-router only calls parse and stringify on it, which still exist in version 9.

What I did not verify:

• npm run typecheck failed because node_modules isn't installed here, so tsc didn't run.
• npm run test:ops failed on a missing git committer identity in this sandbox.
• I haven't built or run the mobile or web app, so expo-router's route and query-param handling on query-string 9 is untested.
• I did not touch #29, which edits the same two files for the katex upgrade; the lockfile hunks are separate.

Dependency review

Passed. 9 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 9 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 9 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Landed on main in bba76b3 together with the other two dependency updates (katex 0.19.0, query-string 9.5.1 with decode-uri-component 0.5.0, and uuid 11.1.1 under xcode), on top of main as it is now, with the lockfile resolved once for all three. Closing this one as done there.