Remove sprintf-js path and backport Forge/Braces security fixes

README.md

@@ -39,6 +39,7 @@ pnpm android     # open on an Android emulator
 pnpm ios         # open on an iOS simulator
 pnpm web         # run the web target
 pnpm lint        # run Expo lint checks
+pnpm security:test # check dependency fixes and normal parsing/signing behavior
 
 eas build --platform android --profile development  # Android dev build
 eas build --platform android --profile preview      # Android preview APK
@@ -56,6 +57,12 @@ eas update --branch production --message "message"  # production OTA update
 - Sent history and queued messages are kept in memory for the current app session. Mock auth state is stored with `expo-secure-store`, with a web localStorage fallback.
 - EAS is configured for development, preview, and production builds in `eas.json`; the Android production submit profile expects `service-account-play-store.json`.
 
+## Dependency security
+
+The pinned pnpm install applies reviewed source patches to `image-size`, `node-forge` and `braces`. The Forge patch follows [upstream PR 1152](https://github.com/digitalbazaar/forge/pull/1152) at `ceba34402e329f0365134f23fe19898756527d65`: RSA verification rejects extra nested DigestInfo fields while retaining valid AlgorithmIdentifier forms. Brace parsing and AST operations reject nesting at 128 levels and cyclic ASTs with `BRACES_MAX_DEPTH`; normal globs, escapes and ranges remain supported.
+
+Istanbul's NYC configuration loader resolves `js-yaml` 4.3.2, removing its older YAML/`sprintf-js` path. `pnpm security:test` checks that loader and the actual Expo signing and glob dependencies. No audit threshold or advisory allowlist was weakened. Version-based audits and Dependabot may continue to flag the two unreleased Forge/Braces advisories even with these local patches; source regression checks and normal CI must be considered alongside those still-open alerts. Replace the backports with upstream releases after their compatibility and release age are verified.
+
 ## Architecture
 
 ![Thunkd architecture diagram](./architecture.png)

package.json

@@ -8,7 +8,7 @@
     "start": "node scripts/dev-server.mjs expo start",
     "android": "node scripts/dev-server.mjs expo start --android",
     "ios": "node scripts/dev-server.mjs expo start --ios",
-    "security:test": "node scripts/security/image-size-regression.mjs",
+    "security:test": "node scripts/security/image-size-regression.mjs && node scripts/security/nyc-config-regression.mjs && node scripts/security/forge-braces-regression.mjs",
     "web": "node scripts/dev-server.mjs expo start --web",
     "lint": "expo lint"
   },
@@ -64,10 +64,13 @@
       "baseline-browser-mapping@<2.11.0": "2.11.27",
       "browserslist@<4.28.7": "4.28.9",
       "@humanfs/node@<0.16.8": "0.16.8",
-      "decode-uri-component": "0.5.0"
+      "decode-uri-component": "0.5.0",
+      "@istanbuljs/load-nyc-config@1.1.0>js-yaml": "4.3.2"
     },
     "patchedDependencies": {
-      "image-size@1.2.1": "patches/image-size@1.2.1.patch"
+      "image-size@1.2.1": "patches/image-size@1.2.1.patch",
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch",
+      "braces@3.0.3": "patches/braces@3.0.3.patch"
     }
   },
   "private": true

patches/braces@3.0.3.patch

@@ -0,0 +1,112 @@
+diff --git a/lib/check-depth.js b/lib/check-depth.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..0fbf12c49569e54a3bc1eeeedb193536fe16b2a5
+--- /dev/null
++++ b/lib/check-depth.js
+@@ -0,0 +1,25 @@
++'use strict';
++
++// Validate before any recursive AST walk, including direct AST callers.
++module.exports = ast => {
++  const pending = [[ast, 0]];
++  const active = new Set();
++  while (pending.length) {
++    const [node, depth, leaving] = pending.pop();
++    if (leaving) {
++      active.delete(node);
++      continue;
++    }
++    if (!node || typeof node !== 'object') continue;
++    if (depth >= 128 || active.has(node)) {
++      const error = new SyntaxError('Brace AST exceeds the safe nesting limit or contains a cycle');
++      error.code = 'BRACES_MAX_DEPTH';
++      throw error;
++    }
++    active.add(node);
++    pending.push([node, depth, true]);
++    if (Array.isArray(node.nodes)) {
++      for (const child of node.nodes) pending.push([child, depth + 1]);
++    }
++  }
++};
+diff --git a/lib/compile.js b/lib/compile.js
+index dce69beb90ece5c3b0ca234a949418f9f34eedbc..ebf33f65092abeab15fed6011df4340515230eea 100644
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
+
++const checkDepth = require('./check-depth');
++
+ const fill = require('fill-range');
+ const utils = require('./utils');
+
+ const compile = (ast, options = {}) => {
++  checkDepth(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+diff --git a/lib/expand.js b/lib/expand.js
+index 35b2c41d6afdb8f0197959e26079f266e48370d3..4988f808dfac66cb4e28c52dae69ef87c102faae 100644
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,5 +1,7 @@
+ 'use strict';
+
++const checkDepth = require('./check-depth');
++
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+ const utils = require('./utils');
+@@ -31,6 +33,7 @@ const append = (queue = '', stash = '', enclose = false) => {
+ };
+
+ const expand = (ast, options = {}) => {
++  checkDepth(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+
+   const walk = (node, parent = {}) => {
+diff --git a/lib/parse.js b/lib/parse.js
+index 3a6988e629f52aee6609dc5ec290a5e9ff47cecb..44b1591227e4ba698d9ae1b482c6ca707b75e325 100644
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -144,6 +144,11 @@ const parse = (input, options = {}) => {
+
+     if (value === CHAR_LEFT_PARENTHESES) {
+       block = push({ type: 'paren', nodes: [] });
++      if (stack.length >= 128) {
++        const error = new SyntaxError('Brace pattern exceeds the safe nesting limit');
++        error.code = 'BRACES_MAX_DEPTH';
++        throw error;
++      }
+       stack.push(block);
+       push({ type: 'text', value });
+       continue;
+@@ -210,6 +215,11 @@ const parse = (input, options = {}) => {
+       };
+
+       block = push(brace);
++      if (stack.length >= 128) {
++        const error = new SyntaxError('Brace pattern exceeds the safe nesting limit');
++        error.code = 'BRACES_MAX_DEPTH';
++        throw error;
++      }
+       stack.push(block);
+       push({ type: 'open', value });
+       continue;
+diff --git a/lib/stringify.js b/lib/stringify.js
+index 8bcf872c31894f81a8c64d9202fd607e4fd7ea2b..706a62abe364d8c1f17dea8f736648c8251d227d 100644
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
+
++const checkDepth = require('./check-depth');
++
+ const utils = require('./utils');
+
+ module.exports = (ast, options = {}) => {
++  checkDepth(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;

patches/node-forge@1.4.0.patch

@@ -0,0 +1,15 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+index a4264822b4dcd6dca44ca3e59e410c982eed7183..94f5d3340818ad007e45c4c2578af52721f8f1f9 100644
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1172,7 +1172,9 @@ pki.setRsaPublicKey = pki.rsa.setPublicKey = function(n, e) {
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            obj.value[0].value.length !==
++              (('parameters' in capture) ? 2 : 1)) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');